Exclusive-Hackers targeted US private equity, other firms including Blackstone, CME, data shows

By Raphael Satter, AJ Vicens and Anirban Sen

WASHINGTON, Aug 6 (Reuters) – Ransom-seeking hackers who use phone calls to compromise their victims targeted dozens of prominent U.S. financial institutions and other businesses over the past month, according to Google and internet intelligence data reviewed by Reuters.

The data shows the hackers devised websites aimed at stealing passwords from employees of private equity firms and companies including Blackstone, Bridgewater Associates, Apollo Global Management, Bain Capital, KKR, TPG, CME Group and Moody’s, as well as a host of financial companies and other businesses. Internet company Google said in a blog post about the hacking campaign published on Thursday that the hackers operate under a range of names, including Redact, Pink, Falcon, and Helix.

Google declined to comment on Reuters findings. Its blog said in some cases companies, which it did not name, paid ransoms to the hackers. Reuters could not establish which companies the hackers successfully compromised. 

Experts say the hackers’ use of low-tech tactics such as phone calls to target the financial industry illustrates how, despite sophisticated security programs and AI-driven threats, the oldest tactics still rank among the most effective. If successful, the hacks could compromise data of some of the biggest U.S. private equity firms that provide capital to companies.

“Because the fence is now so fancy and high-tech, we just have to trick the guard into opening the door for us,” said Lee Clark, a cyberthreat intelligence production manager with the Retail and Hospitality ISAC, an industry information sharing and analysis group.

“That human element consistently is why this has exploded in the way it has,” he said.

KKR, Bain Capital, CME, TPG and Apollo declined to comment. Blackstone, Bridgewater Associates and Moody’s did not immediately respond to requests for comment.

HACKERS SHIFT ATTENTION: GOOGLE

 In its blog post, Google — a unit of Alphabet — said the hackers had recently turned their attention to private equity, law firms, and financial ratings agencies.

Austin Larsen, the principal threat analyst at Google’s Threat Intelligence Group, said the hackers generally targeted industries based on financial calculations, often successfully.

“Really, it’s a money thing,” Larsen said. “They think that these firms or organizations have data sensitive enough that, if taken, they would pay to prevent it.”

Google did not identify any of the hackers’ targets by name. Reuters reverse-engineered many of the company-specific online traps used by the hackers by running the 72 malicious websites Google listed in its report through web intelligence platforms such as DomainTools and urlscan, which flagged malicious subdomains tailored to each firm.

Speaking in general about the subdomains, Larsen said “they all were likely used in attempted intrusions” though he cautioned “they were not all successful.” 

Google said the hackers used “meticulous social engineering tactics,” reaching employees on their personal cellphones while pretending to call from their company’s help desk, sometimes displaying the correct help desk phone number. The hackers told their targets there was an urgent directive from IT to update their passkeys or multifactor authentication and steered the employees toward a booby-trapped website with domain names such as “passkeyhelpdesk” or “secure-passkey.” If an employee followed the instructions to enter their password, the hackers would harvest their fail-safe passcode – typically sent by text or generated by an app – live over the phone and hijack their account before the call terminated.

Larsen said it was wrong to think of the tactic as particularly advanced.

“Sophisticated is not the right word,” he said. “It is just really effective.”

SHIFTING ALIASES

Reuters was not able to reach the hackers. Redact — which once went by the name Darkfiles — said on its darknet website that its hackers “are not politically or morally motivated” and were “not currently taking questions from the press.” 

Larsen said it was unclear who the hackers were exactly or what their relationship was to one another. Although they went under different names, he said they appeared to be tied together by common infrastructure.

“There are still some unknowns here,” he said.

The hacking attempts, a few of which were earlier reported by Bloomberg, have caused a stir on Wall Street.

For example, Point72 Asset Management told investors on Wednesday ​that it had been targeted by hackers, according to a source familiar with the matter.

That source – and a second source familiar with the matter – said the ​hackers had also attempted to breach other hedge funds, ​including Two Sigma Investments and Citadel, whose names also appeared in the data reviewed by Reuters.

Two Sigma and Point72 have not returned messages seeking comment. Citadel declined to comment.

A host of other firms were in the hackers’ crosshairs before they pivoted to financial institutions, according to Google’s blog post and the data.

The data shows that the cybercriminals built digital traps for more than 200 companies in the past five weeks alone, including the ride hailing company Uber, online broker Zillow , and jeans brand Levi Strauss, as well as several law firms, including Paul Hastings and Greenberg Traurig. 

Uber, Zillow, Paul Hastings, and Levi Strauss did not immediately return messages seeking comment. In a statement, Greenberg Traurig said it “did not have a data breach given the layers of security protocols we have in place to protect client data and the firm.” It did not elaborate.

(Reporting by Raphael Satter, AJ Vicens and Anirban Sen; Editing by Rod Nickel and Nick Zieminski)