On Thursday, a report issued by Google's security researchers unveiled that a cohort of unidentified cyber attackers is setting their sights on prominent U.S. financial and investment entities. They are stealing confidential data and leveraging it for blackmail purposes. Among the affected organizations are illustrious private equity and financial corporations, including Apollo Global Management, Bain Capital, Blackstone Group, Bridgewater Associates, CME Group, KKR, Moody's, and TPG Capital.
The attackers initiate contact with employees via their personal mobile phones, masquerading as coworkers or IT support personnel. Through this ruse, they deceive their targets into inputting their login credentials and multi-factor authentication codes on counterfeit websites, thereby gaining unauthorized system access. Additionally, certain hacker factions manage websites to publicly showcase their 'achievements' and intimidate victims with data leakage threats unless ransom demands are met.
Google's researchers have indicated that these cyber onslaughts are still in progress and might be orchestrated by a larger, overarching group, designated by the codename UNC6671.