One Phone Call Past the Firewall: Deconstructing UNC6671's Vishing Playbook Against Private Equity

On September 14, Google Threat Intelligence Group published a routine report. The names of victims were withheld. Standard operational security practice, standard corporate politeness. In an appendix, the report published 72 web addresses tied to a call-back phishing infrastructure. Reuters fed those URLs through DomainTools and urlscan, and the subdomains resolved to Blackstone, Bridgewater Associates, Apollo Global Management, Bain Capital, KKR, TPG, CME Group, Clearlake Capital, and Moody's. The so-called anonymity evaporated in an afternoon. The intrusion vector is not a zero-day. It is not a supply chain exploit, a kernel vulnerability, or a novel cryptographic break. It is a telephone call. The attackers pose as IT helpdesk staff, tell employees their laptops need an urgent security update, and direct them to a spoofed login portal. Some firms paid up, according to Google. The report does not name which ones. This campaign tells you something structural about the modern security ecosystem: a well-funded organization can spend eight figures on endpoint detection, SIEM infrastructure, and zero-trust networking, and a former call center worker with a script can walk past all of it in under eleven minutes. I have spent the better part of a decade auditing things that break in spectacular technical ways. I have found arithmetic overflows in constant product formulas, verification gaps in ZK rollup circuits, and consensus layer bottlenecks nobody saw coming. The highest-severity findings were never in the math. They were always in the assumptions. The same principle applies to UNC6671. This attack chain did not exploit a flaw in Microsoft 365 or Okta. It exploited an assumption baked into every identity federation layer: that the human on the other end of the phone is human, and that the human is who they say they are. Both assumptions are now false. The campaign, tracked by Google as UNC6671, runs on a pipeline that is almost disappointingly mechanical. The call comes in. Scam Likely screeners miss it because the caller ID is spoofed to match the corporate IT desk. The employee is told to visit a portal that looks like their SSO login. They enter their credentials. They enter their MFA code. The adversary-in-the-middle panel captures both. Credentials and tokens are forwarded to the real service, rendering the user's session valid to a complete stranger. Then automated scripts pull documents, mailboxes, and cloud storage from Microsoft 365 and Okta. No malware. No binary deobfuscation. No privilege escalation dance. Just identity theft, productized. Let me be exact about why AiTM works, because the subtlety matters. Multi-factor authentication is designed to prove that a subject is present. The premise is that possession of the token plus knowledge of the credential constitutes proof of identity. But a proxy sits between the user and the legitimate provider, relays the session tokens in real time, and becomes the valid user. The MFA check passes because the user genuinely typed the correct code. The cryptographic proof of identity is satisfied by the user themselves, who has been socially engineered into transmitting the proof to a relay rather than to the relying party. The user has successfully authenticated. They just authenticated against the wrong system. This is not a weakness in TOTP, WebAuthn, or passkey protocols. It is a weakness in the deployment assumption: that authentication is an event. It is not a property of the authentication channel. It is a property of the entire session lifecycle, from the moment the request lands to the moment the session expires. UNC6671 has realized what most security vendors have not: the session itself is the perimeter, and a session hijack is a perimeter bypass that no next-generation firewall can see. I recall, during my audit of early zk-Rollup fallback mechanisms in 2020, I spent weeks reconstructing circuit constraints designed to secure a fraud proof window. The cryptography was sound. The vulnerability was in the operational assumption that the withdrawal delay was long enough for anyone to notice. It was a systemic mismatch between the security model and the human behavior model. The same mismatch is visible here. These companies comply with every control framework. Their SOCs staff three shifts. The attack violates none of their policies. The targeting shift is where this campaign becomes analytically interesting. Through June, UNC6671 leaned toward technology, transport, and hospitality companies, harvesting trade secrets, source code, and client records. These are classic espionage targets. Average difficulty, moderate payout, moderate downstream value. In July, the infrastructure pivoted to private equity firms, law firms, and financial rating agencies. This is not a random preference change. This is a calculated shift in economic parameters. Private equity is a hub-and-spoke structure of access. A single principal at a GP firm carries credentials to their own firm's virtual data rooms, incoming deal pipelines, and fund finances, but that is just the vertex. The same identity system usually federates into portfolio company environments, investor reporting platforms, administrator portals, and the SaaS stacks of dozens of operating companies. Compromise one partner account at a PE firm and you are not compromising one cloud tenant. You are compromising a recursive graph of interlinked tenants, each with its own data-breach notification obligations, each with its own regulated data types, and each with a parent company that will negotiate quietly to make the problem disappear. The math is the story. I have spent years checking the math against the narrative. It never matches. Consider the cost structure of UNC6671's operation. The hardware is trivial: a VoIP subscription, a phishing kit, a reverse proxy, a domain registrar. The infrastructure per campaign is maybe a few hundred dollars. The callers are probably paid on commission, similar to any outbound sales operation. Meanwhile, the target firm maintains a security budget in the tens of millions. The expected loss from a single vishing success, based on the reputational damage and potential regulatory exposure alone, is orders of magnitude higher than the cost of the campaign. The ROI asymmetry is so extreme that the surprise is not that this happens. The surprise is that it does not happen more often. Check the math, not the roadmap. When you do, the entire narrative of the cybersecurity industry turns sideways. The industry has organized itself around the detection and prevention of malicious code. It has built a marketplace around the breach of one system by another system. It is largely unprepared to defend against the breach of a system by a human being using a telephone as a protocol tunneling agent. Voice is the lowest-layer protocol still in widespread organizational use. You cannot run an endpoint agent on the public phone network. You cannot deploy a detection rule on a human being's ear. There is a market dimension to the infrastructure exposure that Reuters surfaced. The 72 domains were not random alphabet soup. The subdomains were matched to each corporate family. This tells us the attacker mapped the target's identity infrastructure before the campaign. It tells us they observed which SSO provider each firm used. It tells us they studied the login flow, the Okta dashboard, the Microsoft branded portal for password resets. This is reconnaissance discipline analogous to a network mapper crawling a perimeter before an exploitation attempt. But the perimeter here is perceptual. The attackers mapped what the employees would reasonably expect to see. This is the part I want the reader to internalize: these attacks are sloppy in execution but immaculate in preparation. The auto-exfil scripts, the AiTM panels, the subdomain enum - all of it works because the attacking group has reduced the target profile to a set of predictable interactions. A worried employee receiving a helpdesk call at their personal mobile, which the report notes is a deliberate technique, bypasses corporate call recording and security awareness reminders. The personal device is outside the governance boundary. The attack deliberately exits the perimeter before the perimeter is even approached. That detail is significant. The targeting of personal mobile devices means the attacker researched the employee's personal phone number, or got it from an enumeration of breached corporate directories. This is a data-driven attack paradigm. Every previous breach of any service, every exposed telephone number in a third-party leak, becomes a component of the next vishing attempt. The credential dumps that firms believe have no residual value because passwords are rotated are still valuable. Phone numbers do not rotate. The contrarian angle, and the one I think matters most, is that this campaign is not a failure of end-user vigilance. It is a failure of identity architecture at the enterprise level. Organizations have spent two decades federating everything into a single identity layer. Single sign-on was always sold as a security convenience. It is also a single point of failure. When the identity layer is the attacker's target, the consolidation of identity into one portal makes the work easier for the attacker, not harder. I spent 2024 analyzing sequencer centralization in L2 networks. The key finding was that while the protocols marketed decentralization, their transaction orderer was effectively a single process. Institutional due diligence was dazzled by the consensus layer narrative and ignored the mempool. The structural parallel here is almost painful. These firms market a mature security program. They submit to controls audits. They publish vendor due diligence reports. But when an employee authenticates to a convincing proxy, all the audit findings evaporate. Audits are snapshots, not guarantees. They validate the configuration at a moment in time. They do not test whether a telephone call can reroute the identity flow around the controls. The deeper problem is architectural. The modern cloud identity stack has a well-defined trust anchor: the identity provider. Everything else - the email platform, the document store, the HR system - defers to that anchor. An AiTM panel does not attack the anchor. It becomes the anchor from the user's perspective and relays the trust chain onward. The user believes they are authenticating to the corporate identity provider. They are authenticating to the attacker's infrastructure, which then authenticates to the real provider with the user's real tokens. From the provider's perspective, everything checks out. The provider is correct. The provider is also irrelevant. This means the standard remediation advice - enforce MFA, implement conditional access, deploy suspicious activity alerts - is a necessary but insufficient response. Let me be explicit about what would actually change the dynamics. The session needs to be bound to a device fingerprint that the user's browser cannot leak through a proxy. The identity provider needs to detect relayed session patterns: asymmetric HTTPS fingerprints, non-local login geolocation, token replay timing inconsistencies. The tooling exists in parts, but it is not integrated. Complexity is the enemy of security. The industry's response to social engineering has historically been to add another layer of control, which is exactly the wrong direction. The solution is to reduce the attack surface from the human to the machine. The phone call, the voice, the urgency - all of it is irrelevant if the MFA token is cryptographically bound to the immediate device and cannot be relayed. WebAuthn comes close. Device-bound passkeys have the property of origin binding. But deployment is still minimal, and the average enterprise Okta tenant is still using TOTP or SMS fallback. The fallback mechanism is the attack surface. Code does not care about your vision. An attacker will take the path of least resistance, and as long as a rotatable six-digit code is valid input for a relay attack, the path will remain open. There is also the question nobody can answer publicly. Google says some firms paid up. Reuters could not determine which targets were actually breached. The distinction between "targeted" and "breached" is doing a lot of work here. In my experience, when an attacker has harvested a valid session token from an AiTM relay, the data exfiltration is scripted, quiet, and can be mistaken for normal training activity or pipeline runs. The attackers do not deploy ransomware immediately. They copy. They stage. They monetize data via brokers. The downstream market for confidential PE deal documents and litigation strategy files is sophisticated and quiet. If I were running the due diligence on the affected firms' response, I would ask one question: how fast did you rotate every session token, not just the credential? Token revocation is the only remedy against a completed AiTM attack. Change the password, and the stolen session still walks until its expiry. Log out of the compromised session, and the attacker loses the foothold. The most common failure mode I have seen in incident response is partial remediation: reset the credential, leave the session alive. The attacker checks back in the next morning. I cannot verify the exact state of the affected firms' incident response programs. I can note that the campaign was active for months, that the infrastructure was substantial enough to warrant a dedicated Google report, and that the reporting cycle averages several months behind the initial compromise. The timeline is not reassuring. The underlying economics of the shift to PE targets is worth restating because it reframes how institutions should prioritize. The attackers are not pursuing trophy scalps. They are pursuing data with asymmetric downstream value. A rating agency's internal methodology files, a GP's cap table, a law firm's deal negotiation memos - these are all assets with a stable secondary market, unaffected by crypto confiscation or seizure rates. The data is monetizable in ways that ransomware cannot match. Ransomware demands a one-time payment against a deadline. Data theft against a PE firm is a perpetual annuity. Sell the access once, sell the extracted data multiple times to multiple buyers. The sector will adapt slowly because the sector is structurally incentivized to maintain the status quo. Security spend is a compliance item, justified by audit findings and insurance premiums. The probability of a phone call becoming an unauthorized data exfiltration is difficult to project, so it gets underfunded. The math says this is irrational. The institutional behavior says otherwise. And if there is one thing a protocol auditor learns, it is that human institutions do not change until the irreversibility of the loss becomes unignorable. This is the nature of a security crisis: it is not announced in advance, and the warning signals are visible only in retrospect. The 72 domains are now public. The subdomains have been cataloged. The campaign is still active. The target list will change. The method will not. What concerns me is the trajectory: this campaign has demonstrated that voice phishing works against the highest-resourced victim class in the financial sector. The playbook will be repackaged, resold, and run as a service. The barrier to entry is dropping. When a threat actor can buy an AiTM kit, a spoofed number, and a script in the same afternoon, the marginal cost of launching a vishing campaign against a mid-sized fund is effectively zero, and the expected value is positive at any payout above a few thousand dollars. The private equity response to this class of attack is still being written. The incident reports are sealed. The negotiated settlements are confidential. But the infrastructure evidence has a shape, the domain registrations have a timeline, and the attacker behavior has a logic. None of it is benign. A final observation. The campaign underscores a lesson that keeps recurring in every domain I audit: the attacker rarely needs to break the system. They simply need to find where the system trusts something it should not trust. The organizations in the perimeters of the 72 domains spent heavily on preventing the last decade's attacks. The attacker spent a fraction of that to abuse the most ancient trust relationship in the organization: the one between a worried employee and a helpful voice on the phone. Every year, the industry builds higher walls. The vectors evolve away from the walls. The telephone does not care about the firewall. It rings. Someone answers. The perimeter is already gone. The question, as it always is, is whether the security architecture will learn faster than the attacker reinvests. The math is not encouraging. It never is.