A cybercriminal group known as UNC6783 is targeting firms by first compromising their business process outsourcing (BPO) partners.

Google’s Threat Intelligence Group (GTIG) reports that numerous companies have been victimized in this way, with sensitive data stolen for extortion purposes.

GTIG’s Austin Larsen notes that UNC6783 commonly uses social engineering and phishing schemes to infiltrate BPOs that work with the intended targets.

In some instances, the group has contacted support staff at target companies directly, attempting to get unauthorized access.

Researchers suggest UNC6783 might be linked to a threat actor known as Raccoon, who has a history of attacking BPOs that serve large businesses.

In live chat-based social engineering attacks, the group directs support staff to fake Okta login pages that are hosted on domains that resemble those of the target company and follow a specific pattern.

Larsen adds that the phishing tools used in these attacks can copy clipboard contents, enabling the attacker to bypass multi-factor authentication (MFA) and register their own device.

Google has also seen UNC6783 use fake security updates to spread remote access malware.

After stealing private data, the threat actors extort victims through ProtonMail, demanding payment.

While GTIG didn’t offer more details about Raccoon, the International Cyber Digest account recently reported that someone using the name “Mr. Raccoon” claimed to have breached Adobe, a claim the company hasn’t confirmed.

The attacker claimed to have accessed Adobe’s data by compromising an India-based BPO working for the company, deploying a remote access trojan (RAT) on an employee’s computer before targeting the employee’s manager with a phishing attack.

Mr. Raccoon claimed to have stolen 13 million support tickets containing personal data, employee records, HackerOne submissions, and internal documents.

The perpetrator of the CrunchyRoll breach told BleepingComputer that they were also responsible for the Adobe attack, but offered no proof.

Google’s Mandiant recommends using FIDO2 security keys for MFA, monitoring live chat for suspicious behavior, blocking fake domains that mimic Zendesk, and regularly checking MFA device registrations to defend against UNC6783 attacks.