UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data

Overview

Recent cyber attacks attributed to the threat actor UNC6671 have raised alarms across financial services, private equity, and professional services sectors. This data extortion group has refined its attack methodology to rely heavily on voice phishing (vishing), a social engineering technique that uses phone calls to deceive victims into divulging sensitive information.

“UNC6671 continues to rely on voice phishing (vishing) to target enterprise employees, posing as IT help desk staff facilitating mandatory, urgent security migrations.”

Notably, the threat actor often reaches employees through their personal mobile phones, a tactic that bypasses traditional enterprise communication security measures and increases the likelihood of successful manipulation.

Attack Vector: Vishing Through Personal Phones

The attackers impersonate IT help desk personnel, creating a sense of urgency around security migrations that are allegedly mandatory. By contacting employees on personal devices, UNC6671 exploits the blurred boundary between work and personal life, making it harder for targets to verify the legitimacy of the request.

Why Personal Phones?

• Bypass Corporate Security: Enterprise phone systems often have call logging, monitoring, and filtering. Personal phones lack these protective layers.
• Increased Trust: A call to a personal number feels more direct and personal, reducing suspicion.
• Circumvent MDM Policies: Mobile Device Management (MDM) solutions may not cover personal devices, limiting the organization’s visibility.

Targets and Impact

UNC6671 predominantly targets organizations in financial services, private equity, and professional services. These sectors handle highly sensitive data and rely heavily on SaaS applications for critical operations, making them lucrative targets for data extortion.

Primary Objective: SaaS Data Theft

The ultimate goal is to steal access credentials to SaaS platforms (e.g., email, cloud storage, CRM, ERP systems). Once the attackers gain access, they exfiltrate confidential data and demand ransom payment to prevent its release. The stolen data may include:

• Client and customer records
• Financial documents
• Intellectual property
• Employee personal information

“Significantly, the threat actor often contacts employees via their personal phones, enabling a more direct and trusted vector for credential theft.”

Attack Methodology

While specific technical details remain scarce, the vishing attack sequence generally follows a predictable pattern:

1. Initial Reconnaissance: The attackers gather employee names, job roles, and phone numbers from public sources or prior breaches.
2. Call Initiation: The victim receives a call on their personal phone from a spoofed number that appears to be from the company’s IT help desk.
3. Urgency and Authority: The caller claims a mandatory security migration is required immediately, often referencing a fake threat or system outage to increase stress.
4. Credential Harvesting: The victim is asked to provide their current login credentials, verify MFA codes, or visit a phishing link to complete the migration.
5. Access and Exfiltration: Using the stolen credentials, the attacker accesses SaaS accounts, disables security controls, and exfiltrates data.

Mitigation and Defense

Organizations should adopt a multi-layered approach to defend against vishing attacks targeting personal phones:

Employee Education

• Train staff to recognize vishing techniques and the specific risk of unsolicited calls on personal devices.
• Emphasize that IT help desks will never ask for passwords or MFA codes over the phone.
• Encourage employees to verify any urgent request by using official communication channels (e.g., calling the help desk back via the number on the corporate intranet).

Technical Controls

• Implement robust MFA that includes phishing-resistant factors (e.g., hardware tokens or biometrics).
• Use conditional access policies to block sign-in attempts from unusual locations or devices.
• Monitor for anomalous login behavior, especially after-hours or from unknown IPs.
• Deploy SaaS security posture management (SSPM) tools to detect misconfigurations and unauthorized access.

Incident Response

• Establish a clear procedure for employees to report suspected vishing attempts.
• Maintain a response plan for credential compromise, including immediate password reset, session revocation, and forensic analysis.
• Collaborate with law enforcement and threat intelligence sharing groups to track UNC6671 activity.

Conclusion

UNC6671’s shift to vishing via personal phones represents a significant threat to enterprise data, particularly in high-value sectors. By combining social engineering over personal communication channels and targeting SaaS credentials, the group exploits human trust and security gaps. Organizations must proactively address this risk through education, technical controls, and a strong incident response posture.

This report is based on the available scraped context; further investigation may reveal additional technical indicators and defensive strategies.