UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data

A data extortion group known as UNC6671 is behind a recent wave of cyber attacks targeting financial services, private equity, and professional services. The group uses voice phishing, or vishing, to target enterprise employees, posing as IT help desk staff to facilitate fake security migrations. UNC6671 contacts employees via their personal phones, attempting to steal SaaS data. The attacks are characterized by their urgency, with the threat actor claiming the migrations are mandatory. The goal of these attacks is to obtain sensitive information from the targeted employees.