Hackers Are Calling: The Vishing Campaign Targeting Financial Institutions

The most consequential cyberattacks hitting the financial sector this summer did not start with malware or a zero-day exploit. They started with a phone call.

On August 21, Apollo Global Management disclosed in a letter filed with the California Attorney General that attackers used social engineering to gain access to its cloud environment between July 6 and July 10, taking names, dates of birth, contact information, and Social Security numbers. Apollo was not alone. Reuters has reported that dozens of prominent U.S. financial institutions—including Blackstone, KKR, Bain Capital, Bridgewater, TPG, CME Group, and Moody’s—were targeted by the same ransom-seeking campaign. Google’s Threat Intelligence Group, which tracks the actors as UNC6671 and links them to the Redact, Pink, Helix, and Falcon extortion brands, describes the playbook: attackers call employees on their personal mobile phones, pose as IT helpdesk staff pushing an urgent security migration, and steer them to spoofed