Private equity firms have become the latest target of ransom-seeking hackers who use voice phishing to trick company employees, according to a new Google report.

The report withheld the names of the firms targeted. Reuters worked them out by feeding the 72 web addresses Google published into tools like DomainTools and urlscan, which surfaced subdomains matched to each company.

Inside the Vishing Campaign

In its latest report, Google Threat Intelligence Group (GTIG) said it continues to track a group known as UNC6671. The actors rely on voice phishing (vishing), posing as IT helpdesk staff pushing urgent security updates.

They often reach employees on personal mobile devices. The calls direct victims to spoofed login portals.

There, adversary-in-the-middle (AiTM) systems intercept credentials and multi-factor authentication (MFA) tokens. Once inside, the hackers run automated scripts to pull data from cloud services like Microsoft 365 and Okta.

“These operations uniformly leverage tailored IT helpdesk voice phishing (vishing), AiTM credential harvesting panels, and data theft from SaaS applications,” the report read.

Follow us on X to get the latest news as it happens

A Shift Toward High-Value Targets

The choice of victims shifted over the summer. Through June, the group leaned toward technology, transport, and hospitality names, chasing trade secrets, code, and client data.

The following month, it turned to money and law. Google saw the group’s infrastructure pointed at private equity firms, law firms, and financial rating agencies.

According to Reuters, hackers created fake sites to lift passwords from staff at several firms. The outlet listed Blackstone, Bridgewater Associates, Apollo Global Management, Bain Capital, KKR, TPG, CME Group, Clearlake Capital, and Moody’s, among others.

Google said some firms paid up, without naming them. Reuters also could not pin down which targets were actually breached.

The campaign highlights how old-school techniques still beat modern defenses. Firms spend heavily on security software, yet a single phone call can walk past all of it.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights

Source: BeInCrypto