Point72 Asset Management, Millennium Management, Two Sigma Investments, Citadel and several private-equity firms have been targeted in a recent wave of cyberattacks by UNC6671, an extortion group linked to the BlackFile campaign, Reuters and Bloomberg reported. The attacks used voice phishing to trick employees into granting access to corporate systems; Point72 said it found no evidence client data was stolen, while Two Sigma said it blocked an attempted intrusion.

Google's Threat Intelligence Group tracks the activity as UNC6671, which previously operated under the "BlackFile" brand and has since diversified across multiple extortion brands including Redact, Pink, Helix and Falcon, according to threat analyst Austin Larsen. The group initially targeted retail and hospitality organisations before shifting in July 2026 toward private-equity firms, hedge funds, law firms and financial-rating agencies.

Attackers contact employees on personal phones while impersonating corporate help desks, directing them to phishing websites that steal credentials and session cookies, Lawrence Abrams reports for BleepingComputer.