UNC6783 Turns BPO Providers into Cyberattack Gateways

Google Threat Intelligence Group reports that UNC6783 (possibly linked to a persona known as "Raccoon") is actively targeting BPO companies to gain access to large enterprises. The group uses phishing and live-chat social engineering to direct employees to fake Okta-like login pages, employs a toolkit that can capture clipboard data to bypass MFA and register devices, distributes fake security updates that install remote access trojans, and exfiltrates support data for extortion. Mandiant recommends FIDO2 hardware keys, monitoring live chat systems, blocking lookalike domains, and auditing MFA device registrations.