A sophisticated cybercrime campaign has targeted employees at some of the largest U.S. private equity firms, including Blackstone, Apollo Global Management, and KKR, using deceptive phone calls designed to steal employee credentials and bypass multifactor authentication.<\/p>\n\n\n\n
According to Google, the attackers relied on social engineering rather than advanced malware. They impersonated internal IT help desk staff, often calling employees on their personal mobile phones while spoofing legitimate company phone numbers. The callers claimed there was an urgent need to update security settings, passkeys, or multifactor authentication.<\/p>\n\n\n\n
The campaign paired convincing phone calls with company-specific phishing websites that closely resembled legitimate IT support portals. Victims were instructed to log in or enter one-time authentication codes, allowing the attackers to capture passwords and session credentials in real time.<\/p>\n\n\n\n
Google said the hackers created customized phishing infrastructure for more than 200 organizations over a five-week period. Besides Blackstone, Apollo, and KKR, other reported targets included Bain Capital, TPG, CME Group, Moody’s, Clearlake Capital, Bridgewater Associates, and several law firms and corporations.<\/p>\n\n\n\n
Cybersecurity researchers believe the attackers have increasingly shifted their attention toward private equity firms, financial institutions, and professional services companies because of the highly sensitive financial information and privileged access these organizations possess.<\/p>\n\n\n\n
Google identified the threat actors under several aliases, including Redact, Pink, Falcon, and Helix. While some organizations reportedly paid ransoms, it remains unclear which companies, if any, were successfully compromised. The targeted firms have largely declined to comment publicly.<\/p>\n\n\n\n
The campaign highlights that human-focused attacks continue to be one of the most effective techniques available to cybercriminals. Rather than exploiting software vulnerabilities, the attackers manipulated employees into voluntarily handing over credentials, underscoring the importance of verifying unexpected IT requests through official internal channels and never sharing passwords or authentication codes over the phone.<\/p>\n","protected":false},"excerpt":{"rendered":"
A sophisticated cybercrime campaign has targeted employees at some of the largest U.S. private equity firms, including Blackstone, Apollo Global Management, and KKR, using deceptive phone calls designed to steal employee credentials and bypass multifactor authentication. According to Google, the attackers relied on social engineering rather than advanced malware. They impersonated internal IT help desk […]<\/p>\n","protected":false},"author":6,"featured_media":18953,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2,43],"tags":[],"class_list":["post-18951","post","type-post","status-publish","format-standard","has-post-thumbnail","category-featured","category-general-news"],"acf":[],"yoast_head":"\n