Google security researchers reported in August 2026 that multiple hacking groups are breaking into large U.S. financial and investment firms, stealing sensitive data, and extorting victims with threats to publish it publicly.
The groups — which Google named Falcon, Helix, Pink, and Redact — are using voice phishing, or vishing: calling employees on their personal cellphones while posing as coworkers or IT helpdesk staff, then tricking them into entering login credentials and multi-factor authentication codes on spoofed websites. Reuters reported that targets include Apollo Global Management, Bain Capital, Blackstone, Bridgewater Associates, CME Group, KKR, Moody’s, and TPG, though Google did not name victims in its report. None of those firms responded to requests for comment.
Google believes the four groups may all operate under a larger collective it tracks as UNC6671, though the exact relationship — whether affiliates, splinter groups, or shared infrastructure — remains unclear. “We believe that this most likely reflects a coordinated group of threat actors operating multiple public extortion brands possibly in an effort to compartmentalize operations, hide overall breach volumes, and isolate any negotiation fallout,” Google’s researchers wrote.
Some groups run public websites where they announce breaches and threaten to leak stolen data unless victims pay ransoms typically ranging from $750,000 to $3 million. One cryptocurrency wallet linked to a group received approximately $10 million in Bitcoin in the first few months of 2026.
The hackers have previously targeted manufacturing, real estate, healthcare, insurance, tech, transportation, and hospitality companies. Their more recent focus on legal and financial organizations — particularly those involved in mergers, acquisitions, and litigation — may reflect a strategy to pursue high-value confidential data that increases leverage in extortion demands, according to Google’s researchers.
Source: TechCrunch