Cyberattacks against hedge funds and private equity firms have been attributed to UNC6671, an extortion group connected to the BlackFile threat actors. The campaign represents an escalating threat to the financial sector.
Security researchers have linked a recent surge in cyberattacks targeting financial institutions to UNC6671, a threat group reportedly affiliated with BlackFile operators. The campaign has affected hedge funds, private-equity firms, and other financial organizations.
UNC6671 uses extortion tactics, likely exfiltrating sensitive data before encrypting systems to pressure victims into paying ransoms. The group's connection to BlackFile—a known ransomware-as-a-service operation—suggests coordinated infrastructure and techniques.
Financial firms are high-value targets due to their access to capital and sensitivity around confidential client information. The attacks underscore the need for enhanced endpoint detection, network segmentation, and incident response readiness.
Organizations should review backup strategies, monitor for suspicious lateral movement, and prepare containment procedures. Incident response teams should coordinate with law enforcement and threat intelligence providers to assess exposure and develop mitigation strategies.
A Go-based malware distributed through ClickFix attacks is targeting macOS users to steal cryptocurrency, passwords, and Apple Keychain data. The infostealer campaign combines social engineering with credential harvesting.
A former NSA official has warned against connecting water infrastructure controllers to the internet following suspected Iranian cyberattacks on U.S. water systems.
Security researchers scanning Polish government websites discovered critical vulnerabilities that could expose courts, hospitals, and airports to cyberattacks. The vulnerabilities stem from common software used to manage and display web content.
A critical SQL injection vulnerability in Metabase is being actively exploited in the wild to steal customer data. The zero-day attack has already compromised instances at Framework and Tally.