Hedge fund cyberattacks tied to BlackFile-linked UNC6671 extortion group

UNC6671 (associated with the BlackFile extortion campaign and multiple public brands) is conducting targeted vishing and adversary‑in‑the‑middle attacks against hedge funds, private-equity firms, and other financial organizations to steal SSO credentials and exfiltrate cloud data for extortion; investigators report multiple high-value targets, tracked Bitcoin payments, and ongoing assistance from Mandiant and GTIG.