UNC6671
❔ UnknownLast active: 2026-08-10First seen: 2026-08-06
0
linked CVEs
Targeted industries
FinanceTechnologyTransportationHospitalityHealthcareLegalManufacturingReal EstateInsuranceEnergyRetailConstructionMediaAerospaceDefenseTelecommunications
UNC6671 is involved in credential harvesting operations, utilizing vishing tactics to impersonate IT staff and directing victims to enter credentials on a victim-branded site. They have gained access to Okta customer accounts and employed PowerShell to download sensitive data from SharePoint and OneDrive. Their extortion tactics include aggressive harassment of victim personnel, and they have used unbranded extortion emails with different Tox IDs for communication. The threat actors have shown a preference for registering domains with Tucows, indicating potential operational differences from related threat groups.
Source: misp_galaxy · Collected: 2026-08-11
⚡ Vulnerabilities & Exploits0 CVEs
threat_actor_cve → cves / exploits.cve_ids
No CVE correlation on record for this actor yet.
🔍 Detection Coverage0 Sigma
Derived from linked CVEs — not a direct actor match
No Sigma rules mapped via this actor's CVEs yet.
🧬 YaraComing soon
🛰️ Infrastructure & IOCs83
| domain | startpasskeysetup.com | — | 2026-08-10 |
| domain | passkeystatus.com | — | 2026-08-10 |
| domain | secure-passkey.com | — | 2026-08-10 |
| domain | sqfepjvmrd.xyz | — | 2026-08-10 |
| domain | ssopasskey.com | — | 2026-08-10 |
| domain | oktaenroll.com | — | 2026-08-10 |
| domain | idokta.com | — | 2026-08-10 |
| domain | myoktasso.com | — | 2026-08-10 |
| domain | mypasskeysso.com | — | 2026-08-10 |
| domain | setupssopasskey.com | — | 2026-08-10 |
| domain | passkeyms.com | — | 2026-08-10 |
| domain | keyokta.com | — | 2026-08-10 |
| domain | portalpasskey.com | — | 2026-08-10 |
| domain | oktaportalsso.com | — | 2026-08-10 |
| domain | passkeyportal.com | — | 2026-08-10 |
| domain | passkeyportalsetup.com | — | 2026-08-10 |
| domain | addoktapasskey.com | — | 2026-08-10 |
| domain | deploypasskey.com | — | 2026-08-10 |
| domain | mysecurepasskey.com | — | 2026-08-10 |
| domain | activatemypasskey.com | — | 2026-08-10 |
| domain | createpasskey.com | — | 2026-08-10 |
| domain | registerpasskey.com | — | 2026-08-10 |
| domain | setupsso.com | — | 2026-08-10 |
| domain | passkeycenter.com | — | 2026-08-10 |
| domain | passkeyregister.com | — | 2026-08-10 |
| domain | secureauthpasskey.com | — | 2026-08-10 |
| domain | createmypasskey.com | — | 2026-08-10 |
| domain | passkeyset.com | — | 2026-08-10 |
| domain | passkeyokta.com | — | 2026-08-10 |
| domain | passkeyadd.com | — | 2026-08-10 |
| domain | passkeydeploy.com | — | 2026-08-10 |
| domain | setpasskey.com | — | 2026-08-10 |
| domain | addmypasskey.com | — | 2026-08-10 |
| domain | passkey-portal.com | — | 2026-08-10 |
| domain | passkeyregistration.com | — | 2026-08-10 |
| domain | portalsetuphub.com | — | 2026-08-10 |
| domain | mynewpasskey.com | — | 2026-08-10 |
| domain | myconnectkey.com | — | 2026-08-10 |
| domain | enablepasskey2fa.com | — | 2026-08-10 |
| domain | passkeyuser.com | — | 2026-08-10 |
| domain | passkeyenroll.com | — | 2026-08-10 |
| domain | startpasskey.com | — | 2026-08-10 |
| domain | oskeysync.com | — | 2026-08-10 |
| domain | assignpasskey.com | — | 2026-08-10 |
| domain | keysyncos.com | — | 2026-08-10 |
| domain | passkeyhelpdesk.com | — | 2026-08-10 |
| domain | passkeycreate.com | — | 2026-08-10 |
| domain | passkeysupport.com | — | 2026-08-10 |
| domain | createssopasskey.com | — | 2026-08-10 |
| ip | 107.128.45.122 | — | 2026-08-10 |
| ip | 38.42.59.171 | — | 2026-08-10 |
| ip | 47.218.103.146 | — | 2026-08-10 |
| ip | 76.103.148.180 | — | 2026-08-10 |
| domain | activatepasskey.com | — | 2026-08-10 |
| domain | activatepasskeyportal.com | — | 2026-08-10 |
| domain | add-passkey.com | — | 2026-08-10 |
| domain | addpasskey2fa.com | — | 2026-08-10 |
| domain | addssopasskey.com | — | 2026-08-10 |
| domain | addyourpasskey.com | — | 2026-08-10 |
| domain | checkpasskey.com | — | 2026-08-10 |
| domain | createmfa.com | — | 2026-08-10 |
| domain | enablepasskey.com | — | 2026-08-10 |
| domain | enrollpasskey.com | — | 2026-08-10 |
| domain | hubpasskey.com | — | 2026-08-10 |
| domain | makepasskey.com | — | 2026-08-10 |
| domain | mspasskey.com | — | 2026-08-10 |
| domain | myaccountsecurity.com | — | 2026-08-10 |
| domain | mypasskeyid.com | — | 2026-08-10 |
| domain | myssopasskey.com | — | 2026-08-10 |
| domain | newpasskey.com | — | 2026-08-10 |
| domain | oskeyconnect.com | — | 2026-08-10 |
| domain | passkey-check.com | — | 2026-08-10 |
| domain | passkey-connect.com | — | 2026-08-10 |
| domain | passkey-enable.com | — | 2026-08-10 |
| domain | passkeyactivation.com | — | 2026-08-10 |
| domain | passkeycreator.com | — | 2026-08-10 |
| domain | passkeyenable.com | — | 2026-08-10 |
| domain | passkeymfa.com | — | 2026-08-10 |
| domain | passkeyrollout.com | — | 2026-08-10 |
| domain | passkeyms.com | — | 2026-05-15 |
| domain | setupsso.com | — | 2026-05-15 |
| ip | 179.43.185.226 | — | 2026-05-15 |
| domain | enrollms.com | — | 2026-05-15 |
📰 Threat Intel Coverage1
Digest reports mentioning this actor (incl. aliases)
| Welcome to BlackFile: Inside a Vishing Extortion Operation | Google Cloud Blog | matched as UNC6671 | 2026-05-15 |