basicsecurity.net
Proof, not just disclosure.
Threats / Actors / UNC6671
UNC6671 Crimeware No ATT&CK entry

UNC6671

Curated page. MITRE ATT&CK has no group entry for UNC6671 (ATT&CK enterprise snapshot of 2026-06-22 checked). This page was compiled by hand from the reporting cited below, not projected from ATT&CK, and has not been rechecked since 2026-08-07.

Our summary of the cited reporting1,2,5: UNC6671 is a financially motivated threat cluster tracked by Google Threat Intelligence Group (GTIG/Mandiant), active since at least early January 2026. It operates in the ShinyHunters-style SaaS data-theft ecosystem but is tracked separately from UNC6661 and UNC6240 to account for evolving partnerships and possible impersonation. Its chain is entirely social-engineering driven: vishing calls impersonating IT staff direct victims to victim-branded…

Origin / sponsor: not established from a curated public advisory — see Coverage & confidence. Not asserted here.

Reported extortion brands
  • BlackFile (extortion brand)2
  • Redact (reported rebrand)5
  • Pink (reported rebrand)5
  • Helix (reported rebrand)5
  • Falcon (reported rebrand)5
Read this as · tier is our editorial call, not MITRE’s

Read as a financially-motivated operator.

GTIG assesses the motivation as financial only. The reporting describes data theft followed by extortion, not encryption.1 The tradecraft below is our mapping of the cited reporting onto ATT&CK techniques; MITRE attributes none of it to this cluster.

active since early January 2026approx.
Activity bounds (reported floor)
approximate1

Known for

signature moves, each sourced to the cited reporting
AccessVishing to victim-branded SSO pages.1
Extortion72-hour extortion with harassment of staff.1
ReachFurthest outcome. The techniques we mapped reach as far as outcome 5 — Lights out — disruption & extortion. (editorial mapping over ATT&CK tactics).

Tradecraft heatmap

ATT&CK techniques mapped onto the five attacker-outcome narratives

Each row is an ATT&CK technique we mapped from the cited reporting1; the row links open each technique’s ATT&CK definition. Each column is one of the five attacker-outcome narratives a defender funds against. A filled cell means this technique’s own ATT&CK tactic defensibly advances that outcome. Two editorial steps here: the technique list is our mapping of GTIG and press reporting (MITRE attributes none of it to this cluster), and the column alignment is our standard call over each technique’s ATT&CK tactics. Enabler tactics (Resource Development, Defense Evasion) heat no column.

1Front door
2Keys to the kingdom
3Lateral reach
4Data at risk
5Lights out
T1566.004 Phishing: Spearphishing VoiceInitial Access
●
T1583.001 Acquire Infrastructure: DomainsResource Development
T1656 ImpersonationDefense Evasion
T1111 Multi-Factor Authentication InterceptionCredential Access
●
T1078.004 Valid Accounts: Cloud AccountsInitial Access / Persistence / Privilege Escalation / Defense Evasion
●
●
T1059.001 Command and Scripting Interpreter: PowerShellExecution
●
T1213.002 Data from Information Repositories: SharePointCollection
●
T1530 Data from Cloud StorageCollection
●
T1657 Financial TheftImpact
●

Reach: the techniques we mapped light columns 1·2·4·5 — furthest is 5 · Lights out. (furthest-position idiom, reused from the landing map).

A dot = this technique advances that outcomeColumn 3 (Lateral reach) is empty — Compare: a hands-on-keyboard intruder lights column 3.
Editorial: the technique→outcome alignment is our call over ATT&CK’s tactic data, not a separately-sourced MITRE edge. Enabler tactics (C2, defense evasion, discovery) heat no column.

Arsenal

named tools & malware in the cited reporting

Not established: named malware. The cited reporting names no malware for UNC6671; it describes PowerShell and the victims’ own SaaS accounts (Okta, SharePoint, OneDrive) used to take data.1 A blank here is a finding, not a claim of harmlessness.

Campaign highlights

attributed operations in the cited reporting

Not established: named campaigns. This page records none for UNC6671, and ATT&CK has no entry to list one. Activity appears here as a campaign only when a named report describes it as one.

Latest activity

and what we cannot yet claim

Compiled by hand on 2026-08-07. Every fact on this page is drawn from the reporting cited below as of that date; the tier and the technique mapping are our editorial calls on it. Reporting published after 2026-08-07 is not reflected.

Not established: whether this group is active now. We do not print a “last seen” date we cannot source. A recent date appears here only when a named advisory states it.

Known exploits. None, and none expected. GTIG states this activity “is not the result of a security vulnerability in vendors’ products or infrastructure”; the chain is social engineering, so there is no CVE to list.1 This is a finding, not a coverage gap.

Coverage & confidence

what we know, and what we don’t

Established (cited)

  • Cluster identity, motivation, and tracking rationale — GTIG/Mandiant primary reporting (Jan–Feb 2026): financially motivated; tracked separately from UNC6661/UNC6240 for partnership-vs-impersonation clarity
  • Initial access — vishing impersonating IT staff; victim-branded SSO credential-harvesting domains (<company>sso[.]com, my<company>sso[.]com, <company>internal[.]com), registered via Tucows (a discriminator from UNC6661's NICENIC registrations) — GTIG
  • Credential/MFA capture — victims directed to enter SSO credentials and MFA codes on the harvesting site — GTIG
  • Post-compromise — Okta customer accounts accessed; PowerShell used to bulk-download data from SharePoint and OneDrive — GTIG
  • Extortion — unbranded emails, distinct Tox ID (separate from UNC6240's negotiation account), 72-hour payment demands, harassment of victim personnel — GTIG
  • Explicitly not vulnerability-driven — GTIG: 'This activity is not the result of a security vulnerability in vendors' products or infrastructure' — the entire chain is social engineering
  • BlackFile extortion brand association — Mandiant public statement
  • Financial-sector victims (hedge funds) — press reporting

    • Coverage gaps — stated, not hidden

  • No MITRE ATT&CK group entry (no G-id) as of the enterprise-attack snapshot 2026-06-22. This page is curated from cited vendor and press reporting, not produced by the deterministic ATT&CK builder, so the deterministic-only guarantee that covers the other actor pages does not apply here.
  • No CVE linkage by design — the chain exploits people and process, not software. This cluster is structurally invisible to the KEV/EPSS-keyed record corpus and to the ATT&CK-keyed actor corpus simultaneously; that double absence is the headline coverage finding of this page.
  • The technique list is our editorial mapping of reported behavior onto ATT&CK techniques — no technique here is MITRE-attributed to this cluster.
  • Rebrand set (Redact, Pink, Helix, Falcon) is single-sourced press reporting citing Google — pending a primary GTIG publication, treat as reported, not confirmed. BlackFile is Mandiant-stated.
  • The names listed are extortion brand names, not vetted group aliases. Brand-versus-operator identity is a claim this corpus cannot yet represent structurally.
  • Relationship to UNC6661/UNC6240 and the ShinyHunters ecosystem unresolved — GTIG's own caveat: separate tracking to account for evolving partnerships and potential impersonation.
  • Victimology beyond financial services not established; victim counts unknown; no public IOC set beyond domain-pattern shapes is catalogued here (we link to infrastructure lists, never host them).
  • Threat tier is our editorial classification, not a MITRE field, and is labeled as such.