Cybercriminals hack US financial firms using voice phishing: Google report
What's the story
Cybercriminals are using a simple yet effective technique of voice phishing, or "vishing," to hack into major US financial and investment firms. The attackers call employees' personal cellphones, posing as coworkers or IT helpdesk staffers, and trick them into providing their credentials and multi-factor codes on fake websites. Google Security researchers revealed this in a report published on Thursday.
Targeted companies
Private equity firms among victims
The report didn't name the specific firms that were attacked, but Reuters has identified several leading private equity firms among the victims.
These include Apollo Global Management, Bain Capital, Blackstone, Bridgewater Associates, CME Group, KKR, Moody's, and TPG.
The hacking groups behind these attacks are known as Falcon, Helix, Pink, and Redact.
Extortion methods
Some hacking groups have ransom negotiation websites
Some of the hacking groups have websites where they announce their hacks and threaten to leak stolen data unless a ransom is paid.
One such site said, "We conduct every negotiation on professional terms. The publication of your data is never our preferred resolution; it is the consequence of refusal to engage, deliberate stalling, or failure to honor an agreement."
Collective operations
Hacking groups may be part of larger collective
Google researchers suspect that the different hacking groups could all be part of a larger umbrella collective, which they track under the name UNC6671.
However, it's still unclear if these are affiliates or splinter groups.
The report said, "We believe that this most likely reflects a coordinated group of threat actors operating multiple public extortion brands possibly in an effort to compartmentalize operations."
Sector targets
Attacks also on manufacturing, healthcare, hospitality sectors
The hacking groups have also targeted large companies in manufacturing, real estate, healthcare, insurance, tech transportation, and hospitality.
They aim to steal "valuable intellectual property, software source code, or sensitive VIP client data."
Recently, their focus has shifted to legal and financial organizations such as private equity firms.
Google researchers said this could be a strategy to target high-value corporate confidential data for extortion demands.