UNC6671Threat actor
UNC6671 is involved in credential harvesting operations, utilizing vishing tactics to impersonate IT staff and directing victims to enter credentials on a victim-branded site. They have gained access to Okta customer accounts and employed PowerShell to download sensitive data from SharePoint and OneDrive.From MISP Galaxy
Last reported 30 days ago, by Sekoia.io3 reports
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1036Masquerading
“UNC6671 uses credential harvesting panels hosted on generic root domains masquerading as being related to passkeys, appending victim-specific subdomains to facilitate targeted voice phishing campaigns.”
- T1053.005Scheduled Task
“Many hosts had malicious scheduled tasks executing obfuscated PowerShell scripts, and many of those hosts had PowerShell monitoring disabled.”
- T1110.004Credential Stuffing
“…ing dozens of companies and selling nearly a billion stolen records from services like MyFitnessPal and Dubsmash, largely through credential-stuffing attacks against developers' GitHub accounts.”
- T1195Supply Chain Compromise
“Current phase: Advanced SaaS supply-chain compromises and OAuth token theft.”
- T1550.002Pass the Hash
“Lateral movement was achieved mostly through RDP with compromised credentials, though other attacks like Pass-the-Hash were also observed.”
- T1556.009Conditional Access Policies
“Restrict and Alert on Residential Proxy Authentication: Create conditional access policies and anomaly alerts for SSO authentication attempts originating from commercial VPN providers (Mullvad, Private Layer) or unassociated residential broadband proxy pools (AT&T, Comcast, Chart…”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Gotta Breach 'Em All! The Journey Of ShinyHunters“Google tracks the live intrusion clusters behind that year's activity as UNC6661 and UNC6671, both centered on vishing and SSO compromise, with UNC6240 continuing to serve as the branded extortion arm “ShinyHunters” that claims credit for the resulting data.”
-
Google Links Redact Extortion Group to BlackFile Rebrand“According to an analysis by Google Threat Intelligence Group (GTIG), despite BlackFile (UNC6671) having announced the retirement of its brand in 2026, it had now rebranded to Redact.”
-
UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments“UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments”
Indicators in its reports
named in the reports above- passkeyhelpdesk[.]comin 2 reports
- passkeydeploy[.]comin 2 reports
- security[.]orgin 1 report
- tucows[.]comin 1 report
- publicdomainregistry[.]comin 1 report
- azurenetfiles[.]netin 1 report
- 142.11.200[.]186in 1 report
- politie[.]nlin 1 report
- portalpasskey[.]comin 1 report
- addssopasskey[.]comin 1 report
- passkeyms[.]comin 1 report
- mysecurepasskey[.]comin 1 report
- oskeysync[.]comin 1 report
- keysyncos[.]comin 1 report
- setupsso[.]comin 1 report
- idokta[.]comin 1 report
- passkeyuser[.]comin 1 report
- passkeyportal[.]comin 1 report
- createssopasskey[.]comin 1 report
- myoktasso[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.