Phone-Scam Hackers Target Wall Street Giants in Ransom Plot

Ransom-seeking hackers have targeted dozens of prominent US financial institutions and other major businesses over the past month, according to Google and internet intelligence data reviewed by Reuters. The hackers devised malicious websites aimed at stealing passwords from employees of private equity firms and financial companies, including Blackstone, Bridgewater Associates, Apollo Global Management, Bain Capital, KKR, TPG, CME Group, Clearlake Capital and Moody's. Google said in a blog post published on Thursday that the hackers operate under a range of names, including Redact, Pink, Falcon and Helix. Google declined to comment on Reuters' findings. Its blog said in some cases, companies which it did not name, paid ransoms to the hackers. Reuters could not establish which companies the hackers successfully compromised. Experts say the hackers' use of low-tech tactics such as phone calls to target the financial industry illustrates how, despite sophisticated security programs and AI-driven threats, the oldest tactics still rank among the most effective. If successful, the hacks could compromise data of some of the biggest US private equity firms that provide capital to companies. "Because the fence is now so fancy and high-tech, we just have to trick the guard into opening the door for us," said Lee Clark, a cyberthreat intelligence production manager with the Retail and Hospitality ISAC, an industry information sharing and analysis group. "That human element consistently is why this has exploded in the way it has," he said. KKR, Bain Capital, Clearlake Capital, CME, TPG and Apollo declined to comment. Blackstone, Bridgewater Associates and Moody's did not immediately respond to requests for comment. In its blog post, Google said the hackers had recently turned their attention to private equity, law firms and financial ratings agencies. Austin Larsen, the principal threat analyst at Google's Threat Intelligence Group, said the hackers generally targeted industries based on financial calculations, often successfully. "Really, it's a money thing," Larsen said. "They think that these firms or organisations have data sensitive enough that, if taken, they would pay to prevent it." Google did not identify any of the hackers' targets by name. Reuters reverse-engineered many of the company-specific online traps used by the hackers by running the 72 malicious websites Google listed in its report through web intelligence platforms such as DomainTools and urlscan, which flagged malicious subdomains tailored to each firm. Speaking in general about the subdomains, Larsen said, "They all were likely used in attempted intrusions" though he cautioned, "They were not all successful." Google said the hackers used "meticulous social engineering tactics," reaching employees on their personal cellphones while pretending to call from their company's help desk, sometimes displaying the correct help desk phone number. The hackers told their targets there was an urgent directive from IT to update their passkeys or multifactor authentication and steered the employees toward a booby-trapped website with domain names such as "passkeyhelpdesk" or "secure-passkey." If an employee followed the instructions to enter their password, the hackers would harvest their fail-safe passcode – typically sent by text or generated by an app – live over the phone and hijack their account before the call terminated. Larsen said it was wrong to think of the tactic as particularly advanced. "Sophisticated is not the right word," he said. "It is just really effective." Reuters was not able to reach the alleged hackers. Redact — which once went by the name Blackfile — said on its darknet website that its hackers "are not" and the message cuts off.