THREAT OPS › Threat News › UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments
UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments
<div class="block-paragraph_advanced"><p>Written by: <span style="vertical-align: baseline;">Tyler McLellan,</span><span style="vertical-align: baseline;"> </span><span style="vertical-align: baseline;">Austin Larsen</span></p> <hr /></div> <div class="block-paragraph_advanced"><h3><span style="vertical-align: baseline;">Introduction</span></h3> <p><span style="vertical-align: baseline;">Google Th
MITRE ATT&CK techniques
Indicators of compromise
- 68a3ad0b80290ff51410cc95d0b1e728d5ffaa933e2230b291bd48fbdc406756sha256
- https://www.virustotal.com/gui/collection/68a3ad0b80290ff51410cc95d0b1e728d5ffaa933e2230b291bd48fbdc406756url
- 31.7.56.61ipv4
- 193.34.212.132ipv4
- 31.7.56.52ipv4
- 185.178.208.153ipv4
- 23.234.75.84ipv4
- 195.140.213.114ipv4
- 195.140.213.115ipv4
- 107.128.45.122ipv4
- 76.103.148.180ipv4
- 38.42.59.171ipv4
- 47.218.103.146ipv4
- passkeyhelpdesk.comdomain
- portalpasskey.comdomain
- addssopasskey.comdomain
- passkeyms.comdomain
- mysecurepasskey.comdomain
- passkeydeploy.comdomain
- oskeysync.comdomain
- keysyncos.comdomain
- setupsso.comdomain
- idokta.comdomain
- passkeyuser.comdomain
- passkeyportal.comdomain
- createssopasskey.comdomain
- myoktasso.comdomain
- mypasskeysso.comdomain
- setupssopasskey.comdomain
- mspasskey.comdomain
- activatepasskey.comdomain
- enrollpasskey.comdomain
- keyokta.comdomain
- oktaenroll.comdomain
- oktaportalsso.comdomain
- passkeyportalsetup.comdomain
- addoktapasskey.comdomain
- deploypasskey.comdomain
- activatemypasskey.comdomain
- registerpasskey.comdomain