Hackers Spoofed 72 Sites and Phoned Private Equity Staff to Extort Hundreds of Thousands

Google researchers reported that hackers tracked as UNC6671 built 72 spoofed login portals and phoned employees at Blackstone, Apollo, KKR, Bain Capital, and Bridgewater. Staff were tricked into entering passwords and MFA codes. Some attacks yielded ransoms up to $750,000. Apollo confirmed its cloud systems were breached July 6–10, 2026.