The Phony Call of Cyber Extortion: Why Voice Phishing is Still Wildly Effective

The cybersecurity landscape often pits hackers against those trying to protect us from them. However, sometimes it’s not about sophisticated exploits or zero-day vulnerabilities – but rather good old-fashioned trickery that succeeds. A recent report from Google highlights how groups of unknown hackers are using voice phishing techniques to breach large financial and investment firms in the United States.

At first glance, this might seem like a relic of the past. However, these groups have been quite successful with their tactics, stealing sensitive data to extort victims by threatening to publish it. The creation of websites to publicize hacks and threaten to leak stolen data underscores how effective this approach has been.

The groups in question – dubbed Falcon, Helix, Pink, and Redact by Google, with possible ties to a larger collective known as UNC6671 – have infiltrated major players like Apollo Global Management, Bain Capital, Blackstone, Bridgewater Associates, CME Group, KKR, Moody’s, and TPG. These firms, often involved in high-stakes transactions, mergers, and acquisitions, are prime targets for the hackers’ extortion demands.

One of the most striking aspects of this story is the apparent willingness of these groups to compartmentalize their operations, hiding breach volumes and isolating any fallout from negotiations. This suggests a level of sophistication that’s unsettling – and raises questions about how these groups can operate with such impunity.

The ongoing struggle between hackers who continually adapt and evolve their tactics, and those trying to keep up, is highlighted by this story. While high-profile breaches often grab headlines, the fact is that more mundane threats like vishing are still wildly effective – and it’s precisely this kind of social engineering that can be so difficult to detect.

The lack of response from some of these targeted firms adds fuel to the fire – suggesting a level of complacency or perhaps even a willingness to pay up rather than deal with the fallout. This sends a clear signal to hackers: extorting sensitive data can be a lucrative business, and one that’s relatively low-risk.

Google’s researchers have found evidence that these groups have targeted companies across multiple sectors – including manufacturing, real estate, healthcare, insurance, tech, transportation, and hospitality. The fact that they’re going after valuable intellectual property, software source code, or sensitive VIP client data underscores the severity of the situation.

The financial reward hackers are getting from their extortion tactics is worrying. Google reports that one cryptocurrency wallet associated with one of the groups received around $10 million in Bitcoin this year alone – and demands typically range between $750,000 to $3 million per victim.

It’s time for companies to wake up to this reality – and for cybersecurity experts to reevaluate their strategies in light of these findings. A more holistic approach is needed: one that involves education, awareness, and proactive measures to prevent these kinds of attacks from happening in the first place.

As we navigate this complex landscape, one thing is certain: voice phishing won’t be going away anytime soon – and companies must take responsibility for their own security practices if they want to avoid becoming the next victims.