Severity
High
Analysis Summary
UNC6783 is a financially motivated threat cluster, potentially linked to the “Mr. Raccoon” persona. First publicly disclosed on April 7, 2026, the group targets high-value organizations across multiple sectors by compromising Business Process Outsourcers (BPOs) and helpdesk employees to steal data and conduct extortion. Its tactics combine social engineering associated with Scattered Spider (UNC3944) with the data extortion methods of ShinyHunters (UNC6240).
UNC6783 primarily exploits live chat platforms to manipulate employees into visiting spoofed Okta login pages. These phishing pages harvest credentials, MFA codes, and clipboard contents, enabling unauthorized authentication. Attackers may enroll their own MFA devices to maintain persistent access. The group also reportedly uses fake security software updates to distribute remote access malware.
Following initial compromise, attackers exploit trusted BPO relationships and single sign-on (SSO) integrations to access enterprise applications, including Salesforce, Microsoft 365, SharePoint, and Zendesk. They identify sensitive information, perform bulk data exports, and exfiltrate data before demanding cryptocurrency payments through Proton Mail communications.
Recommended defenses include phishing-resistant MFA, monitoring suspicious domains and live chat interactions, auditing MFA device enrollments, detecting unauthorized software execution, and alerting on anomalous bulk data exports. Organizations should strengthen BPO access controls and monitor unusual SSO activity.
Impact
- Unauthorized Access
- Sensitive Data Theft
- Data Exfiltration
- Data Extortion
Indicators of Compromise
Domain Name
sso.oktacloud.io
sso.okta-access.com
internal-networks.com
302lnk.com
Remediation
- Implement phishing-resistant MFA to reduce the risk of credential theft and unauthorized access.
- Monitor and block malicious domains impersonating legitimate login and support portals.
- Conduct regular security awareness training to identify social engineering and phishing attempts.
- Monitor authentication logs for suspicious login attempts, unusual locations, and unauthorized MFA device enrollments.
- Deploy and update EDR solutions to detect suspicious executables and remote access malware.
- Monitor unusual data access patterns and bulk data export activities across enterprise applications.
- Enforce least-privilege access controls for employees, third-party vendors, and BPO partners.
- Implement DLP controls to detect and prevent unauthorized transfers of sensitive information.
- Regularly review user permissions, SSO integrations, and third-party access privileges.
- Investigate suspicious activity promptly and revoke compromised sessions and credentials to prevent further unauthorized access.