UNC6671 & UNC6661 Vishing: How RocketReach Data Builds Target Lists
By Tom Daly, Founder and CEO, Priwall by mePrism · November 2026
The short answer:
Okta Threat Intelligence found that Work Panel, a vishing console tied to the UNC6671 / Cordial Spider extortion group, uses RocketReach to pull employee names, direct phone numbers, job titles and LinkedIn profiles for any company domain. Callers use that list to pick targets for fake IT help-desk calls that end in SSO account takeover, bulk SaaS data theft and extortion (Okta Threat Intelligence; GuidePoint Security). The related group UNC6661 runs a similar play, but no published report ties it to RocketReach.
Cybercrime keeps getting faster, and over the past few months it has sped up more than I can remember seeing before. The tooling has caught up with the intent. As we wrote recently, AI has handed ordinary attackers capabilities that used to belong to nation-states, and ARTEX is now the clearest example. Google Threat Intelligence Group describes ARTEX as an “autonomous, multi-agent LLM-driven pentesting and offensive command-and-control (C2) platform” that started as a free GitHub project and still circulates through community forks and a commercial version called ARTEX PRO, even after its creator took the original repository down (Google Threat Intelligence Group). Since late August, GTIG has seen financially motivated extortion groups and suspected espionage operators adopt it. GTIG calls these frameworks “an attractive, low-cost force multiplier” and expects adoption to keep growing.
The speed numbers are hard to take in. Microsoft reported that a China-aligned actor used ARTEX to attempt sign-ins to more than 2,250 tenants, and in several cases went from first targeting to privileged cloud access in under three hours (Microsoft Security). S-RM’s incident responders watched ARTEX agents take over identity infrastructure, cloud systems, source code and perimeter firewalls within 24 hours of initial access. S-RM expects ransomware and data-theft crews to fold it into their playbooks (S-RM). We will see much more of this.
Machine-speed intrusion is half the story. The other half runs at the speed of a phone call, and it starts with a target list that anyone can buy. Two groups show this better than any others right now: UNC6671 and UNC6661.
Key takeaways
-
Two financially motivated groups are targeting employees through voice phishing. UNC6671 (also tracked as Cordial Spider and O-UNC-045, and behind the BlackFile, Falcon, Helix, Pink and Redact extortion brands) and UNC6661 (Snarky Spider) pose as IT staff, take over SSO accounts, steal SaaS data in bulk and extort victims.
-
Okta obtained the attackers' operator console, known as Work Panel. Its Company Lookup tab is described as "a thin wrapper around RocketReach." Starting with a company email domain, it returns employee work emails, direct phone numbers, job titles and LinkedIn profiles. ( Okta Threat Intelligence )
-
Attackers can purchase employee contact information rather than steal it. Okta describes how commercially available data becomes part of the attack workflow.
“The data is not stolen. It is purchased through legitimate channels, then weaponized inside Work Panel.”
Okta Threat Intelligence -
Personal information may extend the attack beyond the workplace. Google reports that UNC6671 often calls employees on personal cell phones and threatens executives at home, including swatting. This suggests B2B contact data may be combined with consumer people-search data. That combination remains our analysis, not a confirmed finding in the published research.
-
Data removal reduces exposure, but it is only one layer of defense. Removing employee records from B2B contact databases and people-search sites shrinks the available target list. It does not replace phishing-resistant MFA or strict help-desk identity verification.
Who are UNC6671 and UNC6661?
Mandiant first separated these clusters in January 2026, while tracking a wave of SaaS data theft carried out under the ShinyHunters name (Mandiant). Both use the same basic play. A caller poses as corporate IT, claims the company is updating MFA or moving to passkeys, and walks the employee to a convincing fake login page. The page relays the password and MFA code to the real identity provider in real time. The attacker then registers their own MFA device and starts pulling data.
UNC6661 (Snarky Spider). Mandiant reports that UNC6661 sends victims to lookalike domains such as companynamesso.com or companynameinternal.com, which are often registered through NICENIC. After signing in, the group moved through SharePoint, Salesforce, DocuSign, Google Workspace and possibly Slack, searching for words like “confidential,” “proposal” and “vpn.” In one case it used a Google Workspace add-on to delete the Okta notice telling the employee a new security method had been enrolled. Its extortion ran under the ShinyHunters brand, with 72-hour deadlines, text messages sent to employees and, in some cases, DDoS attacks against the victim’s websites (Mandiant). CrowdStrike tracks the group as Snarky Spider and says it can start stealing data in under an hour (The Hacker News).
UNC6671 (Cordial Spider, BlackFile and successors). UNC6671 works at a larger scale. Google says it hires callers to run high-volume campaigns, rings employees’ personal cell phones to get around corporate controls, and uses a “mandatory passkey migration” pretext that also explains away the security alerts the victim may see (Google Threat Intelligence Group). Its extortion goes far beyond a ransom note: mass email to employees, threatening voicemails to executives, threats to contact partners and journalists, and in severe cases swatting of company staff.
After BlackFile, the group rebranded. In August, GTIG reported new brands, spoofed help-desk caller ID, and a shift toward private equity, law firms, rating agencies and other businesses involved in M&A. It found fake domains such as company.passkeyms[.]com being registered about every 1.6 days during June and July. According to GTIG, 18 tracked wallets received roughly $10.69 million between January and May 2026, and opening demands ran from $1 million to more than $3 million (Google Threat Intelligence Group). We covered the rebrands in more detail in BlackFile, Helix, and the Rebrand Treadmill.
UNC6661 vs. UNC6671 at a glance
| Comparison | UNC6661 | UNC6671 |
|---|---|---|
| Other names | Snarky Spider (CrowdStrike) | Cordial Spider (CrowdStrike), O-UNC-045 (Okta) |
| Extortion brands | ShinyHunters | BlackFile, Falcon, Helix, Pink, Redact |
| Opening pitch on the call | IT is updating MFA settings | Mandatory passkey migration or required MFA update |
| Phones called | Not specified in reporting | Often employees' personal cell phones; spoofed help-desk caller ID in recent cases |
| Fake domain pattern | companynamesso.com, companynameinternal.com (often NICENIC) | company.passkeyms[.]com, company.setupsso[.]com (mostly Tucows; NICENIC via Work Panel) |
| Apps targeted | SharePoint, Salesforce, DocuSign, Google Workspace, possibly Slack | Microsoft 365, SharePoint, OneDrive, Okta-connected apps, Salesforce, Zendesk |
| Extortion tactics | 72-hour deadlines, texts to employees, DDoS | Mass employee email, executive voicemails, threats to partners and press, swatting |
| RocketReach link | None published | Documented through Work Panel (Okta, GuidePoint) |
| Key sources |
How does Work Panel use RocketReach to pick vishing targets?
The new finding came from Okta Threat Intelligence in late July. Okta obtained Work Panel, a multi-tenant “cybercrime-as-a-service” console used by at least one of the vishing clusters it tracks, O-UNC-045, also known as Cordial Spider (Okta Threat Intelligence). GuidePoint later tied Work Panel deployments directly to UNC6671’s Falcon, Helix, Pink and Redact brands, the group formerly known as BlackFile (GuidePoint Security).
Work Panel is organized like a sales team. Callers get two tools, which the kit’s author sums up as “Company Lookup and SIP.” Managers watch a live queue of victims and review stolen passwords and MFA codes. An admin runs the domains, the phishing pages, the Telegram alerts and a kill switch. Okta assesses that the console was probably “vibe-coded,” meaning built with heavy AI assistance. Okta researcher Moussa Diallo told iTnews it has “the features a SaaS product team would build if they were building a CRM for vishing crews” (iTnews).
Company Lookup is where it gets uncomfortable for anyone in sales. According to Okta, it is a thin wrapper around RocketReach. The caller types in the target company’s email domain and gets back employees’ corporate emails, direct phone numbers, job titles and LinkedIn profiles. The caller then picks someone whose title makes an IT call believable. Operators plug in their own B2B contact-data API key. GuidePoint describes the attack chain as starting with “target reconnaissance (via RocketReach B2B data API),” followed by domain registration through the NICENIC API, then the phishing site, the real-time session relay and the credential capture (GuidePoint Security).
To be clear about what this does and doesn’t say about RocketReach: Okta doesn’t allege a breach. The data is bought the same way any sales team buys it. That is exactly the problem. Many legitimate businesses use B2B contact data, including ours, and anyone with a credit card and an API key can buy the same data.
None of this is new, either. Leaked chats from the Black Basta ransomware group showed members using ZoomInfo and RocketReach to pick targets for social engineering (Dark Reading). In 2022, Okta concluded that the 0ktapus attackers most likely got employee mobile numbers from “commercially available data aggregation services that link phone numbers to employees at specific organizations.” Canada’s CyberAlberta reports that Scattered Spider profiles employees through LinkedIn and ZoomInfo (CyberAlberta). What Work Panel adds is automation: the lookup now sits inside the attack console, one click away from the phishing page.
We have not found published reporting that ties RocketReach or any specific lead-generation vendor to UNC6661. Its playbook is similar, but the evidence for the RocketReach link applies to the UNC6671 / Cordial Spider cluster.
The second dossier: where B2B data ends and people-search data begins
This section is our analysis, not a finding from the published research.
Two facts from the reporting don’t fully line up. Okta describes Work Panel’s lookup as returning work emails and direct phone numbers. Google reports that UNC6671 often calls employees on their personal cell phones, deliberately avoiding corporate channels, and that its extortion includes threatening voicemails to executives and swatting of staff (Google Threat Intelligence Group). Swatting requires a home address. A corporate contact record tells an attacker who someone is and what they do. It usually doesn’t say where they sleep.
That missing piece sits in a different market: consumer people-search sites and data brokers that link a name to a personal mobile number, a home address, relatives and past addresses. Researchers have documented attackers using exactly these sources against corporate leadership. BlackCloak describes criminals building lists of executives and board members from company leadership pages and then looking each person up on sites such as 411.com and Spokeo (CSO Online). As we wrote in our earlier BlackFile analysis, a full consumer dossier can cost very little.
Put the two together and the likely workflow is simple. A B2B lookup produces the org chart and picks the target. A people-search lookup turns that target into a person with a personal phone and a home. The first gets the attacker into the account. The second makes the call believable (“I can see you’re working from home in Carlsbad today”) and gives the extortion its teeth once the data is gone. No published report has yet documented both lookups inside the same intrusion. Incident responders we talk to describe the pattern, and it is the most straightforward way to explain what the public evidence shows.
Why this matters for security and risk leaders
Most vishing defense starts after the phone rings. Phishing-resistant MFA, verified help-desk callbacks, device-bound sessions and alerts on suspicious MFA enrollment are all essential. Okta, Google and GuidePoint each recommend them, and every organization should put them in place.
Work Panel shows that the attack starts earlier, when a caller types in your domain and gets a ranked list of your people. That step costs the attacker almost nothing, and most security programs don’t touch it at all. Every employee record removed from a B2B contact database is one fewer name in Company Lookup. Every personal number and home address removed from a people-search site is one fewer call to a personal phone the security team can’t see, and one fewer address an extortion crew can threaten.
That is the gap Priwall by mePrism was built for. Priwall’s published coverage list includes B2B contact-data providers such as rocketreach.co, zoominfo.com, apollo.io, lusha.com and cognism.com, alongside people-search sites such as Spokeo, Whitepages, TruePeopleSearch and FastPeopleSearch. For a representative sample of Priwall enterprise customers, a signed AICPA AT-C 215 practitioner report from Sensiba found removal rates greater than 92% at 30 days and greater than 99% at 90 days, with a four-day median to first confirmed removal (Priwall efficacy). Removal won’t stop a determined caller on its own. It does make your employees much harder to find, reach and pressure, and it works alongside the identity controls that stop the caller once they get through.
What to do this quarter
Move high-risk roles to phishing-resistant MFA first. Start with help-desk staff, identity administrators, finance and executives, using FIDO2 security keys or passkeys bound to managed devices.
Lock down MFA enrollment. Allow new authenticators to be added only from managed devices and trusted networks, notify users of every change to their authenticators, and alert when an enrollment closely follows a failed or abandoned login (Okta Threat Intelligence).
Publish a single way to verify IT callers. Tell employees that IT will never ask them to visit a link during a phone call, and give them one known number to call back.
Watch for bulk SaaS file access by scripts. Google notes that UNC6671’s SharePoint theft can show up in logs as file previews rather than downloads (Google Threat Intelligence Group).
Reduce the target list. Remove employees, starting with the roles above, from B2B contact databases and people-search sites, and keep removing them, because the listings come back.
Frequently asked questions
What is UNC6671?
UNC6671 is a financially motivated threat cluster tracked by Google Threat Intelligence Group. Other trackers call it Cordial Spider (CrowdStrike) and O-UNC-045 (Okta), and it has operated under the BlackFile, Falcon, Helix, Pink and Redact extortion brands. It uses phone-based social engineering to take over SSO accounts, steals SaaS data in bulk, and then extorts the victim organization.
What is UNC6661?
UNC6661, tracked by CrowdStrike as Snarky Spider, is a vishing and SaaS data-theft cluster that Mandiant identified in January 2026. It impersonates IT staff, harvests SSO credentials and MFA codes through company-branded phishing domains, and has run extortion under the ShinyHunters brand.
Do vishing gangs use RocketReach?
Yes, in at least one documented case. Okta Threat Intelligence found that the Company Lookup feature in Work Panel, a vishing console used by the O-UNC-045 / Cordial Spider cluster, is a wrapper around RocketReach. It returns employee emails, direct phone numbers, job titles and LinkedIn profiles for a target domain. GuidePoint ties Work Panel to UNC6671. Okta does not suggest RocketReach was breached; the data is bought through normal channels.
How do vishing attackers get employees' personal phone numbers?
Published research confirms that UNC6671 calls personal cell phones but does not identify where the numbers come from. B2B contact databases and consumer people-search sites both link phone numbers to named employees, and attackers have been documented using both kinds of source. Using them together is a reasonable inference, not a confirmed finding.
Can removing employee data from data brokers stop vishing?
It reduces how easily an attacker can find, rank and reach employees, especially on personal devices, and it removes home addresses that can be used for extortion and swatting. It works alongside phishing-resistant MFA, controls on MFA enrollment and help-desk verification. It is not a replacement for them.
What is ARTEX?
ARTEX is an open-source, multi-agent AI offensive framework that automates intrusion steps such as reconnaissance, privilege escalation and cloud profiling. Google, Microsoft and S-RM have documented its use by both criminal and suspected state-backed actors since late summer 2026.
At Priwall by mePrism, we remove personal information from 7over 600 data brokers and people-search sites, for individuals and for companies protecting their employees and executives. See what's exposed about you.
