UNC6671

Executive Summary

UNC6671 is a financially motivated threat actor executing highly targeted vishing-based credential‑harvesting and extortion campaigns against organizations using Okta, Microsoft 365, and other cloud SaaS platforms. They deploy subdomain phishing portals registered through Tucows to capture SSO credentials and MFA tokens via Adversary‑in‑the‑Middle techniques, then exfiltrate data with Python and PowerShell scripts while demanding ransom through encrypted channels like Tox or Session.

Goals & Targeting

The actor’s strategic objective centers on financial exploitation of high‑profile organizations worldwide, focusing on sectors with critical cloud deployments—financial services, government, energy, healthcare, defense, and technology. By harvesting SSO credentials and MFA tokens they aim to achieve persistent footholds, enabling both data exfiltration and subsequent extortion. Their choice of voice phishing underscores a reliance on human trust vectors rather than purely technical exploitation. They target regions with complex organizational structures or significant cloud usage, including the US, Canada, UK, Germany, India, Japan, Australia, China, and Russia, among others. The group demonstrates a preference for organizations that rely heavily on Okta and Microsoft 365 for identity management, indicating a calculated effort to maximize impact and leverage widely used platforms. UNC6671 also appears opportunistic, leveraging public CVEs and low‑cost cloud services (e.g., Python, PowerShell) to reduce operational overhead while maintaining effectiveness across different enterprises. Key capabilities such as voice phishing, Adversary‑in‑the‑Middle tactics, credential harvesting portals, MFA bypass, automated exfiltration scripts, and encrypted communication for ransom negotiation underpin the threat actor’s ability to scale its financial gains.

Key Capabilities

• Voice phishing (vishing) / spearphishing voice
• Adversary-in-the-Middle exploitation to bypass MFA and perimeter defenses
• Credential harvesting via custom subdomain‑based phishing portals registered through Tucows
• Single sign-on credential theft from Okta and Microsoft 365
• Multi-factor authentication token capture
• Automated data exfiltration using Python and PowerShell scripts
• Extortion via encrypted communication channels (Tox, Session) and ransom notes
• Credential harvesting via web‑based panels
• Targeted voice phishing campaigns using victim‑specific subdomains
• Operating generic root domains masquerading as passkeys

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

UNC6671’s campaigns are highly methodical, employing a blend of social engineering and technical exploitation to gain initial foothold before extracting data or demanding ransom. The actor frequently registers new phishing domains through Tucows that mimic passkey enrollment portals, then escalates the attack via voice calls posing as IT support to deceive employees into revealing SSO credentials. A notable operational pattern is the use of encrypted channels for ransom negotiation—leveraging Tox or Session—to reduce detection risk. The group’s infrastructure overlaps with other known extortion brands; shared domain registries and similar exfiltration tactics hint at a possible collaborative or umbrella framework. While specific attack timelines are unclear, evidence points to an ongoing presence in multiple geographic locales targeting high‑value public and private sectors. The actor shows flexibility by attempting to exploit both cloud platform credentials and publicly disclosed software vulnerabilities (CVE-2025-61882, CVE-2021-35587), expanding its reach.

IOC Patterns

• Subdomain-based credential harvesting domains registered through Tucows
• Domains referencing passkey or enrollment themes
• Encrypted communication channels like Tox or Session used for ransom negotiation
• Programmatically generated consumer email accounts used in ransom notes
• Exploitation of CVE-2025-61882 and CVE-2021-35587
• Victim-specific subdomains appended to generic root domains for phishing

Recommended Actions

• Conduct comprehensive employee training on vishing and spearphishing voice awareness, emphasizing verification procedures for IT support calls. Deploy network monitoring to detect traffic to newly registered custom phishing domains and block suspicious subdomains via DNS filtering or web proxy rules. Implement MFA methods resistant to Adversary-in-the-Middle attacks—such as app‑based authenticators or push notifications—and enforce least‑privilege SSO permissions within Okta and Microsoft 365. Maintain real‑time threat intelligence feeds on credential‑harvesting domain registrations (Tucows) and block known malicious subdomains or root domains used for phishing panels. Apply patches or mitigations promptly for publicly disclosed CVEs (CVE-2025-61882, CVE-2021-35587) across all affected systems. Monitor outbound data flows from cloud services (SharePoint, OneDrive, Salesforce, Slack) for anomalous exfiltration patterns and limit large-volume data downloads to approved channels.
• suggested_tags
• vishing
• spearphishing voice
• adversary-in-the-middle
• credential harvesting
• MFA bypass
• Okta compromise
• Microsoft 365 compromise
• SSO credential theft
• extortion
• encrypted communication (Tox, Session)
• custom phishing portal
• CVE exploitation
• shared infrastructure