Cybercriminals Target Major U.S. Financial Firms in Vishing Extortion Campaign Google’s security researchers revealed on Thursday that unidentified hacking groups are actively breaching large U.S. financial and investment firms to steal sensitive data and extort victims by threatening to leak it. Among the targeted organizations are prominent private equity firms, including Apollo Global Management, Bain Capital, Blackstone, Bridgewater Associates, CME Group, KKR, Moody’s, and TPG. The attackers tracked by Google under the names Falcon, Helix, Pink, and Redact employ voice phishing (vishing), a social engineering tactic where hackers impersonate coworkers or IT support over phone calls to trick employees into divulging credentials and multi-factor authentication codes on spoofed websites. Some groups operate dedicated leak sites to pressure victims into paying ransoms, with one site stating that data publication is a "consequence of refusal to engage." Google’s report suggests these groups may operate under a larger collective, UNC6671, though their exact relationships whether affiliates, splinter factions, or users of a shared Phishing-as-a-Service infrastructure remain unclear. The researchers speculate the groups may compartmentalize operations to obscure breach volumes and isolate negotiation risks. Beyond financial firms, the hackers have previously targeted manufacturing, real estate, healthcare, insurance, tech, transportation, and hospitality sectors, seeking intellectual property, source code, and VIP client data. Their recent focus on legal and financial organizations particularly those involved in mergers, acquisitions, and litigation appears strategic, aiming to exploit high-value corporate data for maximum extortion leverage. Financially, the groups have seen success: one cryptocurrency wallet linked to the operation received $10 million in Bitcoin in early 2024, with ransom demands typically ranging from $750,000 to $3 million per victim. Representatives for CME Group declined to comment, while the other named firms did not respond to inquiries.