Google Warns of UNC6783 Hacking Group Targeting BPOs in Data Theft Extortion Scheme Google’s Threat Intelligence Group (GTIG) has identified a new cybercriminal group, UNC6783, linked to an individual operating under the alias "Raccoon." The group is conducting data theft extortion attacks against high-value organizations by infiltrating Business Process Outsourcers (BPOs) third-party firms handling customer service, technical support, and other critical functions for larger corporations. By compromising BPOs, UNC6783 gains indirect access to the primary targets’ systems. The group employs a custom phishing kit to bypass security measures, initiating attacks through social engineering tactics in live chat windows. Hackers pose as legitimate support agents, directing employees to fake Okta login pages with deceptive domains (e.g., <org>zendesk-support<##>com). Once credentials are entered, attackers steal clipboard data to enroll their own devices for persistent access. In addition to phishing, UNC6783 deploys fake security updates that install Remote Access Trojans (RATs), allowing remote control of infected systems. After exfiltrating data, the group sends ransom notes via Proton Mail. Google and Mandiant recommend FIDO2 security keys (e.g., Titan Security Keys) over SMS-based authentication, along with monitoring live chat logs, blocking suspicious Zendesk-pattern links, and auditing enrolled devices to prevent unauthorized access. Industry experts highlight the shift in tactics: John Watters (iCOUNTER CEO) notes that UNC6783 exploits trusted partner relationships, while Mika Aalto (Hoxhunt CEO) emphasizes the group’s use of psychological manipulation to bypass technical defenses. Both stress the need for ecosystem-wide security and realistic employee training to counter such threats.