VulnHub

Real-time Cybersecurity News

Critical

Vishing Extortion Group UNC6671 Rebrands After Making Millions

SecurityWeek
Actively Exploited
Phishing

Overview

A vishing extortion group known as UNC6671 has rebranded several times, initially operating under the name BlackFile. The group has expanded its operations by adopting new names including Redact, Pink, Helix, and Falcon, reportedly making millions through their schemes. Vishing, or voice phishing, involves using phone calls to trick individuals into revealing sensitive information or transferring money. This group's activities raise concerns for both individuals and businesses, as they can lead to significant financial losses and a breach of personal data. The ongoing evolution of this group’s branding suggests they are attempting to evade detection while continuing their extortion efforts.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Individuals and businesses targeted by vishing attacks.
  • Action Required: Individuals and organizations should implement caller ID verification, educate staff on recognizing vishing attempts, and use call-blocking services to mitigate risks.
  • Timeline: Ongoing since at least 2021

Original Article Summary

Initially calling itself BlackFile, the group has expanded operations to the Redact, Pink, Helix, and Falcon brands. The post Vishing Extortion Group UNC6671 Rebrands After Making Millions appeared first on SecurityWeek.

Impact

Individuals and businesses targeted by vishing attacks.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since at least 2021

Remediation

Individuals and organizations should implement caller ID verification, educate staff on recognizing vishing attempts, and use call-blocking services to mitigate risks.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Phishing.

Read Original Article

Related Coverage

Drupal patches critical RCE flaws, warns exploits may emerge soon

BleepingComputer

Drupal has released patches for two serious vulnerabilities that could enable attackers to execute code remotely on any website running a supported version of its content management system. These vulnerabilities pose a significant risk, as they could allow unauthorized access and control over the affected sites. Users of Drupal are strongly advised to apply the patches immediately to protect their websites from potential exploitation. The urgency is underscored by the possibility that attackers may quickly develop exploits to take advantage of these vulnerabilities. Website administrators should prioritize this update to safeguard their systems and data.

Oct 17, 2026

Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel

SecurityWeek

A recent investigation revealed that Discover-Tech, an Israeli advertising firm, has been used as a conduit for Candiru's zero-click spyware. This spyware allows attackers to track and fingerprint devices without any user interaction, raising significant privacy concerns. The ads served by Discover-Tech can target specific individuals, making it easier for malicious actors to compromise their devices. This situation is alarming as it highlights the potential misuse of advertising technology for espionage and surveillance purposes, affecting the security of users who interact with these ads. As this information comes to light, it raises questions about how advertising platforms can be exploited and what measures need to be taken to protect users.

Oct 17, 2026

Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants

The Hacker News

Cybersecurity researchers have identified an ongoing campaign where hackers are using compromised Microsoft 365 credentials from ConnectWise Cloud Backup to access the M365 environments of 173 customers. ConnectWise Cloud Backup, previously known as SkyKick, is a service designed for managed service providers to offer cloud-based backup solutions. The attackers are exploiting these stolen credentials to gain unauthorized entry, which poses a significant risk to the affected organizations. This incident not only compromises sensitive data but also raises concerns about the security protocols in place for cloud services used by MSPs. Companies relying on these services should review their security practices and monitor for any unusual activity in their accounts.

Oct 17, 2026

Federal agencies recommend cyber controls, independent testing for frontier AI systems

CyberScoop

Federal agencies have released new cybersecurity guidance aimed at improving the security of AI systems during testing phases, particularly within sandbox environments. While the recommendations are voluntary, they provide a detailed framework for implementing robust cyber controls and conducting independent assessments of frontier AI systems. This guidance is particularly relevant as organizations increasingly experiment with advanced AI technologies, which can introduce unique vulnerabilities if not managed properly. Ensuring these systems are tested securely helps mitigate potential risks before they are deployed in real-world applications. The move reflects a growing recognition of the need for proactive security measures in the rapidly evolving field of artificial intelligence.

Oct 17, 2026

Critical BlockStrap flaw lets hackers run code on Magento servers

BleepingComputer

Researchers have identified a severe vulnerability, designated as CVE-2026-103849, affecting Magento and Adobe Commerce platforms. This flaw could allow attackers to execute arbitrary PHP code on online store servers, posing a significant risk to e-commerce sites using these systems. If exploited, the vulnerability could lead to unauthorized access, data breaches, or even full server compromise. Store owners and administrators are urged to take immediate action to protect their systems. Given the popularity of Magento and Adobe Commerce, this vulnerability could affect a large number of online retailers, making it crucial for them to address this issue promptly.

Oct 16, 2026

Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk

darkreading

Recent campaigns have seen a surge in attacks that impersonate well-known AI brands like ChatGPT. These attacks often employ tactics similar to those used by ClickFix, targeting unsuspecting employees in various enterprises. The goal is to trick users into providing sensitive information or downloading malicious software. This rise in impersonation not only puts individual employees at risk but also threatens the security of entire organizations. As these attackers exploit the popularity of AI tools, it's crucial for companies to educate their staff about recognizing and avoiding such scams.

Oct 16, 2026