Google Reports Vishing Attacks Targeting Financial Firms for Data Extortion

Vishing Attacks on Financial Institutions

Google's security researchers reported that several hacking groups are actively targeting major financial and investment firms in the United States. These groups employ a technique known as vishing, or voice phishing, to gain unauthorized access to company systems. The objective is to steal sensitive data and then extort the victims by threatening to publish the stolen information.

Method of Operation

The hacking groups, which Google has named Falcon, Helix, Pink, and Redact, initiate phone calls to employees' personal cellphones. During these calls, the attackers impersonate co-workers or IT helpdesk staff. Their goal is to trick employees into entering their login credentials and multi-factor authentication codes onto spoofed websites, thereby compromising their accounts.

Extortion Tactics

After successfully exfiltrating data, some of these groups operate websites where they publicize their breaches and issue threats to leak the stolen data. This tactic is a common cybercriminal strategy to pressure victims into paying a ransom. One such site stated, "The publication of your data is never our preferred resolution; it is the consequence of refusal to engage, deliberate stalling, or failure to honor an agreement."

Coordinated Threat Actors

Google researchers suggest that these distinct hacking groups may be part of a larger, coordinated collective, which Google tracks as UNC6671. The researchers believe this structure, with multiple public extortion brands, could be an effort to compartmentalize operations, obscure the total volume of breaches, and isolate the fallout from any negotiation failures.