Skip to navigation

Threat reportRansomwareTL-2026-5191

Falcon Extortion Brand (UNC6671) Claims Buchanan Ingersoll & Rooney PC (US Law Firm) – ~260 GB Data Leak

highACTIVE

ransomware.live lists Buchanan Ingersoll & Rooney PC, a US full-service law firm, as a victim of the Falcon extortion group on 2026-11-03. Falcon claims ~260 GB exfiltrated, including privileged attorney-client communications, M&A documents and a full DynamicCRM export, and threatens re-attacks after alleged stalled negotiations. First disclosed .

Key facts for Falcon UNC6671 extortion

IdentifiersTL-2026-5191
Also known asUNC6671 multi-brand extortion
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsBuchanan Ingersoll & Rooney PC Corporate environment and data holdings (law firm); Microsoft / Okta Microsoft 365, Entra ID and Okta tenants targeted by UNC6671 AiTM and MFA-registration abuse (generic exposure, not confirmed for this victim)
AttributionFalcon (medium confidence)
MalwareDataleak, Falcon ransomware, Pink
MITRE ATT&CK techniquesT1059.001 Command and Scripting Interpreter: PowerShell, T1059.006 Command and Scripting Interpreter: Python, T1070.008 Indicator Removal: Clear Mailbox Data, T1078.004 Valid Accounts: Cloud Accounts, T1090.003 Proxy: Multi-hop Proxy, T1098.005 Account Manipulation: Device Registration, T1213.002 Data from Information Repositories: Sharepoint, T1530 Data from Cloud Storage, T1539 Steal Web Session Cookie, T1550.004 Use Alternate Authentication Material: Web Session Cookie, T1556.006 Modify Authentication Process: Multi-Factor Authentication, T1557 Adversary-in-the-Middle and 4 more in the attack flow
MotivationFINANCIAL
Target sectorslegal, professional-services, finance, health, manufacturing, energy
Target regionsNorth America, australia, united kingdom
Detection rules9 (1 shown free)
Sources12 cited sources

Detection coverage for Falcon UNC6671 extortion

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5191 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: UNC6671 Falcon AiTM Session Replay - Entra ID Sign-In From Known Infrastructure or Attacker User-Agent

Exploitation phase. Searches Entra ID sign-in logs for sign-ins from UNC6671 (Falcon) AiTM reverse proxies (31.7.56.61, 31.7.56.52), phishing backends, exfiltration hosts and residential proxies reported by Google GTIG, or from the Firefox/146 Ubuntu user-agent seen in attacker sessions. Success after an AiTM capture means the actor replayed a validated session (vishing to passkey-themed AiTM panel, T1566.004 / T1557 / T1539 / T1550.004) to reach Microsoft 365 as a valid cloud account (T1078.004). Part of the Falcon / UNC6671 law-firm data-theft campaign TL-2026-5191.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1078.004, T1557, T1539, T1550.004, T1090.003
  • Data sources: azure:aad:signin (index=azure), Entra ID SigninLogs, AADNonInteractiveUserSignInLogs
  • Severity: high
  • Confidence: high

Splunk SPL

index=azure sourcetype="azure:aad:signin" earliest=-24h
| eval user=lower(coalesce('properties.userPrincipalName', userPrincipalName)), src_ip=coalesce('properties.ipAddress', ipAddress), ua=coalesce('properties.userAgent', userAgent), app=coalesce('properties.appDisplayName', appDisplayName), err=coalesce('properties.status.errorCode', 'status.errorCode')
| eval ioc_ip=if(match(src_ip, "^(31[.]7[.]56[.]61|31[.]7[.]56[.]52|193[.]34[.]212[.]132|185[.]178[.]208[.]153|23[.]234[.]75[.]84|195[.]140[.]213[.]114|195[.]140[.]213[.]115|107[.]128[.]45[.]122|76[.]103[.]148[.]180)$"), 1, 0)
| eval ioc_ua=if(match(ua, "Firefox/146[.]0") AND match(ua, "X11; Ubuntu; Linux x86_64"), 1, 0)
| where ioc_ip=1 OR ioc_ua=1
| eval outcome=if(tonumber(err)=0, "success", "failure")
| stats count AS events, sum(eval(if(outcome="success",1,0))) AS successes, sum(eval(if(outcome="failure",1,0))) AS failures, values(app) AS apps, values(src_ip) AS src_ips, values(ua) AS user_agents, max(ioc_ip) AS matched_unc6671_ip, max(ioc_ua) AS matched_attacker_ua, min(_time) AS first_seen, max(_time) AS last_seen BY user
| eval first_seen=strftime(first_seen, "%F %T"), last_seen=strftime(last_seen, "%F %T")
| sort - successes

Microsoft KQL

let unc6671_ips = dynamic(["31.7.56.61","31.7.56.52","193.34.212.132","185.178.208.153","23.234.75.84","195.140.213.114","195.140.213.115","107.128.45.122","76.103.148.180"]);
union isfuzzy=true SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(24h)
| where IPAddress in (unc6671_ips) or (UserAgent has "Firefox/146.0" and UserAgent has "Ubuntu")
| extend Outcome = iff(ResultType == "0", "Success", "Failure")
| summarize Events = count(), Successes = countif(Outcome == "Success"), Failures = countif(Outcome == "Failure"), Apps = make_set(AppDisplayName, 10), IPs = make_set(IPAddress, 10), UserAgents = make_set(UserAgent, 5), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by UserPrincipalName
| order by Successes desc

Sigma

title: Entra ID Sign-In From UNC6671 AiTM Proxy Infrastructure or Attacker User-Agent
id: 3f6c1a52-7b0e-4d8a-9c41-5e2a8d7b1c01
status: experimental
description: Detects Entra ID sign-ins originating from infrastructure reported by Google GTIG for UNC6671 (Falcon) adversary-in-the-middle reverse proxies, backends, exfiltration hosts and residential proxies, or from the Firefox 146 on Ubuntu user-agent seen in attacker sessions. A successful match indicates a replayed session after AiTM credential and token capture.
references:
    - 'https://cloud.google.com/blog/topics/threat-intelligence/unc6671-targets-financial-services-and-enterprise-cloud-environments'
    - 'https://www.ransomware.live/group/falcon'
    - 'https://www.ransomware.live/kql/view/78'
    - 'https://www.ransomware.live/kql/view/79'
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.initial-access
    - attack.t1078.004
    - attack.credential-access
    - attack.t1557
    - attack.t1539
    - attack.defense-evasion
    - attack.t1550.004
    - attack.command-and-control
    - attack.t1090.003
logsource:
    product: azure
    service: signinlogs
detection:
    selection_ip:
        IPAddress:
            - '31.7.56.61'
            - '31.7.56.52'
            - '193.34.212.132'
            - '185.178.208.153'
            - '23.234.75.84'
            - '195.140.213.114'
            - '195.140.213.115'
            - '107.128.45.122'
            - '76.103.148.180'
    selection_ua:
        UserAgent|contains|all:
            - 'Firefox/146.0'
            - 'X11; Ubuntu; Linux x86_64'
    condition: 1 of selection_*
falsepositives:
    - 'Legitimate Linux users running Firefox 146 on Ubuntu'
    - 'Residential proxy addresses 107.128.45.122 and 76.103.148.180 may be shared with unrelated AT&T or Comcast subscribers'
level: high

Known false positives:

  • Legitimate Linux workstation users on Firefox 146 under Ubuntu
  • Residential proxy IPs 107.128.45.122 and 76.103.148.180 are shared consumer addresses and may belong to benign users

Tuning notes: Treat the two residential proxy IPs as low-fidelity and weight matches on AiTM proxy IPs 31.7.56.61 and 31.7.56.52 higher. Allowlist known Ubuntu engineering users for the user-agent clause. Update the IP list from the GTIG report and the community-observed IOC set as it changes. Adjust the index and field names if the Splunk Add-on for Microsoft Cloud Services is configured differently.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • UNC6671 Falcon Passkey/SSO Lookalike Domain and AiTM Proxy Connections From Managed Endpoints · unlock with TL Creds
  • UNC6671 Falcon Entra ID MFA Method Delete and Register (Helpdesk Vishing Takeover) · unlock with TL Creds
  • UNC6671 Falcon Burst of SharePoint/OneDrive Downloads Following Risky Sign-In (AiTM to SaaS Exfil) · unlock with TL Creds
  • UNC6671 Falcon AiTM Phishing Domain Access via Web Proxy · unlock with TL Creds
  • UNC6671 Falcon Mailbox Cleanup of Security Alert and Password Reset Emails · unlock with TL Creds
  • UNC6671 Falcon Exfiltration Host and Leak Site Network Connections · unlock with TL Creds
  • UNC6671 Falcon Okta MFA Enrolment After Authentication Failures or Factor Removal · unlock with TL Creds
  • UNC6671 Falcon SharePoint/OneDrive Bulk File Access via Scripting User-Agents · unlock with TL Creds

Indicators of compromise for Falcon UNC6671 extortion

As of 2026-11-04, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-5191.

Sample indicators (3 of 24)

  • IP address: 31.7.56[.]61
  • Domain: i7loab6thvz4lb7jdr3qoeumbvilwhbgnwsctnlfmvsv7g5s3vsiw6yd[.]onion
  • IP address: 31.7.56[.]52

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

24 indicators of compromise · unlock with TL Creds. Compare plans

Community OSINT corroboration for Falcon UNC6671 extortion

17 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Falcon UNC6671 extortion works

Google GTIG/Mandiant assess Falcon as one of several extortion brands run by the vishing/AiTM SaaS data-theft cluster UNC6671; the victim claim itself is unverified.

On 2026-11-03 (20:21 UTC) ransomware.live indexed Buchanan Ingersoll & Rooney PC (full-service US law firm, Professional Services) as a victim of Falcon. Per the actor's leak-site text as relayed by the tracker, ~260 GB was exfiltrated: a 'full DynamicCRM export with account, contact and campaignresponse', privileged attorney-client communications, settlement analyses, M&A documents, NDAs, board materials, financial data, personnel files and regulatory correspondence with the FDA and DOJ. The actor states the firm 'contacted us then timewasted, re-attacks incoming', implying a stalled ransom negotiation and a threat of repeat intrusion or further leaks. The hunt notes also mention credential/identity directory exports and tax returns; the fetched tracker page did not list these, so they are treated as unconfirmed.

Falcon is not a conventional encrypting ransomware crew. On 2026-08-06 Google Threat Intelligence Group / Mandiant published 'UNC6671 Rebrands' describing a financially motivated data-theft extortion cluster, active since early January 2026, that operates multiple extortion brands: BlackFile (leak site launched 2026-02-06, retired May 2026), Redact, Pink, Helix and Falcon. Vendor cluster IDs cited by TechNadu: BlackFile CL-CRI-1116, Pink CL-CRI-1147, Falcon CL-CRI-1182; CrowdStrike tracks the activity as Cordial Spider. The ransomware.live KQL entries describe 'Falcon (a UNC6671 alias)'. Google reports Falcon uses passkeyhelpdesk.com and related domains and shares infrastructure with Helix and other brands.

UNC6671 tradecraft (from GTIG): operators call employees on personal mobile phones while spoofing the corporate helpdesk, claiming they must enrol a FIDO2 passkey or update MFA. Victims are sent to victim-specific subdomains (e.g. [company].createssopasskey.com) of lookalike root domains hosting Okta/Microsoft Entra ID adversary-in-the-middle panels that capture credentials and MFA tokens and replay the validated session. Post-compromise the actor registers its own MFA device (removing existing ones first), abuses the IdP-to-SaaS trust to reach Microsoft 365, Okta and Salesforce, deletes password-reset confirmations and security-alert emails, and exfiltrates with automated scripts (python-requests, WindowsPowerShell, Go-http-client user agents generating SharePoint FileAccessed events). GTIG tracked 141.65 BTC (~$10.69M) to 18 BlackFile wallets between 2026-01-07 and 2026-05-12, with initial demands of $1M-$3M, reductions of 50-75% and an average payment of ~$750K in over half of cases. Targeting narrowed in July 2026 to financial services and legal organizations (M&A and litigation data), which matches the Falcon late-October law-firm cluster.

Falcon victims on ransomware.live (all US, 7 total): Buchanan Ingersoll & Rooney (260 GB, 2026-11-03), Holland & Knight (listed 2026-11-02 per the victim page), Beasley Allen Law Firm (214 GB, 2026-10-26), Weitz & Luxenberg (82 GB, 2026-10-25/26), Astrana Health (738 GB, 2026-10-25), Hayward Holdings (848 GB, 2026-08-31), Globus Medical (2.96 TB, attack est. 2026-08-21, claimed 2026-08-30, PowerBI database with 51,000+ records) and DistributionNOW (344 GB, attack est. 2026-07-14). The tracker reports a 28-day average delay and that 100% of victims with domain data show infostealer correlation. Falcon runs an NGINX-served onion leak site and publishes a PGP key for contact.

Evidence limits: no CVE, malware sample, encryption behavior, ransom amount or independent victim confirmation exists in the sources. The initial-access method against this specific victim is not confirmed; the vishing/AiTM mapping is inferred from GTIG's brand attribution and the tracker's KQL associations, so it is medium-confidence. No nation-state attribution; motivation is financial extortion. BeaconBeagle lookups (leak-site onion, 31.7.56.61, passkeyhelpdesk.com) returned HTTP 502, so no C2 correlation could be made.

MITRE ATT&CK techniques by tactic:

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.006 Command and Scripting Interpreter: Python

Defense Evasion

T1070.008 Indicator Removal: Clear Mailbox Data

Initial Access

T1078.004 Valid Accounts: Cloud Accounts; T1566.004 Phishing: Spearphishing Voice

Command and Control

T1090.003 Proxy: Multi-hop Proxy

Persistence

T1098.005 Account Manipulation: Device Registration

Collection

T1213.002 Data from Information Repositories: Sharepoint; T1530 Data from Cloud Storage

Credential Access

T1539 Steal Web Session Cookie; T1556.006 Modify Authentication Process: Multi-Factor Authentication; T1557 Adversary-in-the-Middle

lateral-movement

T1550.004 Use Alternate Authentication Material: Web Session Cookie

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583.001 Acquire Infrastructure: Domains

Impact

T1657 Financial Theft

Remediation for Falcon UNC6671 extortion

Immediate actions

  • Hunt Microsoft 365 for FileAccessed/FileDownloaded bursts and scripting user agents (python-requests, WindowsPowerShell, Go-http-client, Firefox/146 on Linux) against SharePoint/OneDrive
  • Review Entra ID/Okta MFA registrations, resets and removals (AuditLogs, system.multifactor.factor.setup), especially those preceded by authentication failures or abandoned push challenges; revoke unrecognized methods and sessions
  • Block and hunt for UNC6671 passkey/MFA/SSO-themed lookalike domains and the listed Private Layer, MEVSPACE, DDoS-Guard, Tzulo and Hydra IPs
  • Alert on helpdesk-impersonation calls to personal mobile phones and brief staff that the helpdesk will never request passkey enrolment by phone link
  • Review export and bulk-download activity in CRM and BI platforms such as Dynamics CRM and PowerBI
  • Law-firm clients of Buchanan Ingersoll & Rooney should ask the firm what client data was held and follow their own breach-notification and privilege obligations

Workarounds

  • No vendor patch applies; no vulnerability is identified in the sources

Longer-term hardening

  • Mandate phishing-resistant MFA (FIDO2 security keys, passkeys, Windows Hello, Okta FastPass) and consolidate SaaS behind SSO
  • Enforce session controls: IP session binding, Device-Bound Session Credentials, Continuous Access Evaluation, short re-authentication and idle timeouts
  • Require corporate-managed devices and trusted network zones for authentication; alert on residential-proxy and commercial VPN sign-ins
  • Add helpdesk identity-verification procedures for password and MFA resets
  • Apply DLP and egress monitoring for bulk SaaS exfiltration; treat FileAccessed with scripting libraries like FileDownloaded in UAL
  • Segment and tightly scope access to privileged client-matter data and M&A repositories

Affected and fixed versions

  • Buchanan Ingersoll & Rooney PC — Corporate environment and data holdings (law firm)
  • Microsoft / Okta — Microsoft 365, Entra ID and Okta tenants targeted by UNC6671 AiTM and MFA-registration abuse (generic exposure, not confirmed for this victim)

Timeline of Falcon UNC6671 extortion

  • GTIG begins tracking UNC6671 / BlackFile bitcoin receipts (141.65 BTC, ~$10.69M, to 2026-05-12); activity documented since early January 2026
  • BlackFile leak site, the original UNC6671 extortion brand, launches
  • BlackFile leak site shutdown notice; on 2026-05-19 Redact operators announce BlackFile's cessation and on 2026-06-27 claim it was hijacked
  • ransomware.live estimates earliest Falcon activity (DistributionNOW attack estimate); Falcon locked-ioc-5 phishing domain registered the same week (2026-07-10)
  • Google GTIG/Mandiant publish 'UNC6671 Rebrands', naming Falcon as one of the BlackFile successor brands sharing infrastructure with Helix
  • Falcon claim against Globus Medical (2.96 TB, attack est. 2026-08-21) reported, including PowerBI data with 51,000+ customer records; DistributionNOW also discovered
  • Falcon lists Hayward Holdings (848 GB)
  • Falcon lists mass-tort law firm Weitz & Luxenberg (82 GB) and Astrana Health (738 GB)
  • Falcon lists litigation firm locked-ioc-3 (214 GB)
  • ransomware.live shows Falcon also targeted law firm locked-ioc-9
  • Falcon claims locked-ioc-2 (~260 GB); ransomware.live indexes the victim at 20:21 UTC and the actor says the firm negotiated, then timewasted, with re-attacks threatened

Sources cited for Falcon UNC6671 extortion

Drafted by the Threadlinqs research pipeline from 12 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats