# Falcon Extortion Brand (UNC6671) Claims Buchanan Ingersoll & Rooney PC (US Law Firm) – ~260 GB Data Leak

> ransomware.live lists Buchanan Ingersoll & Rooney PC, a US full-service law firm, as a victim of the Falcon extortion group on 2026-11-03. Falcon claims ~260 GB exfiltrated, including privileged attorney-client communications, M&A documents and a full DynamicCRM export, and threatens re-attacks after alleged stalled negotiations. Google GTIG/Mandiant assess Falcon as one of several extortion brands run by the vishing/AiTM SaaS data-theft cluster UNC6671; the victim claim itself is unverified.

- **Published:** 2026-11-04T00:38:59Z
- **Last reviewed:** 2026-11-04T00:38:59Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5191
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5191.png
- **ID:** TL-2026-5191
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Falcon
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (3 shown free below)

## Description

On 2026-11-03 (20:21 UTC) ransomware.live indexed Buchanan Ingersoll & Rooney PC (full-service US law firm, Professional Services) as a victim of Falcon. Per the actor's leak-site text as relayed by the tracker, ~260 GB was exfiltrated: a 'full DynamicCRM export with account, contact and campaignresponse', privileged attorney-client communications, settlement analyses, M&A documents, NDAs, board materials, financial data, personnel files and regulatory correspondence with the FDA and DOJ. The actor states the firm 'contacted us then timewasted, re-attacks incoming', implying a stalled ransom negotiation and a threat of repeat intrusion or further leaks. The hunt notes also mention credential/identity directory exports and tax returns; the fetched tracker page did not list these, so they are treated as unconfirmed.

Falcon is not a conventional encrypting ransomware crew. On 2026-08-06 Google Threat Intelligence Group / Mandiant published 'UNC6671 Rebrands' describing a financially motivated data-theft extortion cluster, active since early January 2026, that operates multiple extortion brands: BlackFile (leak site launched 2026-02-06, retired May 2026), Redact, Pink, Helix and Falcon. Vendor cluster IDs cited by TechNadu: BlackFile CL-CRI-1116, Pink CL-CRI-1147, Falcon CL-CRI-1182; CrowdStrike tracks the activity as Cordial Spider. The ransomware.live KQL entries describe 'Falcon (a UNC6671 alias)'. Google reports Falcon uses passkeyhelpdesk.com and related domains and shares infrastructure with Helix and other brands.

UNC6671 tradecraft (from GTIG): operators call employees on personal mobile phones while spoofing the corporate helpdesk, claiming they must enrol a FIDO2 passkey or update MFA. Victims are sent to victim-specific subdomains (e.g. [company].createssopasskey.com) of lookalike root domains hosting Okta/Microsoft Entra ID adversary-in-the-middle panels that capture credentials and MFA tokens and replay the validated session. Post-compromise the actor registers its own MFA device (removing existing ones first), abuses the IdP-to-SaaS trust to reach Microsoft 365, Okta and Salesforce, deletes password-reset confirmations and security-alert emails, and exfiltrates with automated scripts (python-requests, WindowsPowerShell, Go-http-client user agents generating SharePoint FileAccessed events). GTIG tracked 141.65 BTC (~$10.69M) to 18 BlackFile wallets between 2026-01-07 and 2026-05-12, with initial demands of $1M-$3M, reductions of 50-75% and an average payment of ~$750K in over half of cases. Targeting narrowed in July 2026 to financial services and legal organizations (M&A and litigation data), which matches the Falcon late-October law-firm cluster.

Falcon victims on ransomware.live (all US, 7 total): Buchanan Ingersoll & Rooney (260 GB, 2026-11-03), Holland & Knight (listed 2026-11-02 per the victim page), Beasley Allen Law Firm (214 GB, 2026-10-26), Weitz & Luxenberg (82 GB, 2026-10-25/26), Astrana Health (738 GB, 2026-10-25), Hayward Holdings (848 GB, 2026-08-31), Globus Medical (2.96 TB, attack est. 2026-08-21, claimed 2026-08-30, PowerBI database with 51,000+ records) and DistributionNOW (344 GB, attack est. 2026-07-14). The tracker reports a 28-day average delay and that 100% of victims with domain data show infostealer correlation. Falcon runs an NGINX-served onion leak site and publishes a PGP key for contact.

Evidence limits: no CVE, malware sample, encryption behavior, ransom amount or independent victim confirmation exists in the sources. The initial-access method against this specific victim is not confirmed; the vishing/AiTM mapping is inferred from GTIG's brand attribution and the tracker's KQL associations, so it is medium-confidence. No nation-state attribution; motivation is financial extortion. BeaconBeagle lookups (leak-site onion, 31.7.56.61, passkeyhelpdesk.com) returned HTTP 502, so no C2 correlation could be made.

## MITRE ATT&CK

- T1566.004 Phishing: Spearphishing Voice
- T1078.004 Valid Accounts: Cloud Accounts
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1556.006 Modify Authentication Process: Multi-Factor Authentication
- T1098.005 Account Manipulation: Device Registration
- T1550.004 Use Alternate Authentication Material: Web Session Cookie
- T1070.008 Indicator Removal: Clear Mailbox Data
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.006 Command and Scripting Interpreter: Python
- T1583.001 Acquire Infrastructure: Domains
- T1090.003 Proxy: Multi-hop Proxy
- T1213.002 Data from Information Repositories: Sharepoint
- T1530 Data from Cloud Storage
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**UNC6671 Falcon AiTM Session Replay - Entra ID Sign-In From Known Infrastructure or Attacker User-Agent** (`TL-2026-5191-SPL-001`)

Exploitation phase. Searches Entra ID sign-in logs for sign-ins from UNC6671 (Falcon) AiTM reverse proxies (31.7.56.61, 31.7.56.52), phishing backends, exfiltration hosts and residential proxies reported by Google GTIG, or from the Firefox/146 Ubuntu user-agent seen in attacker sessions. Success after an AiTM capture means the actor replayed a validated session (vishing to passkey-themed AiTM panel, T1566.004 / T1557 / T1539 / T1550.004) to reach Microsoft 365 as a valid cloud account (T1078.004). Part of the Falcon / UNC6671 law-firm data-theft campaign TL-2026-5191.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1078.004, T1557, T1539, T1550.004, T1090.003
- **Data sources:** azure:aad:signin (index=azure), Entra ID SigninLogs, AADNonInteractiveUserSignInLogs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=azure sourcetype="azure:aad:signin" earliest=-24h
| eval user=lower(coalesce('properties.userPrincipalName', userPrincipalName)), src_ip=coalesce('properties.ipAddress', ipAddress), ua=coalesce('properties.userAgent', userAgent), app=coalesce('properties.appDisplayName', appDisplayName), err=coalesce('properties.status.errorCode', 'status.errorCode')
| eval ioc_ip=if(match(src_ip, "^(31[.]7[.]56[.]61|31[.]7[.]56[.]52|193[.]34[.]212[.]132|185[.]178[.]208[.]153|23[.]234[.]75[.]84|195[.]140[.]213[.]114|195[.]140[.]213[.]115|107[.]128[.]45[.]122|76[.]103[.]148[.]180)$"), 1, 0)
| eval ioc_ua=if(match(ua, "Firefox/146[.]0") AND match(ua, "X11; Ubuntu; Linux x86_64"), 1, 0)
| where ioc_ip=1 OR ioc_ua=1
| eval outcome=if(tonumber(err)=0, "success", "failure")
| stats count AS events, sum(eval(if(outcome="success",1,0))) AS successes, sum(eval(if(outcome="failure",1,0))) AS failures, values(app) AS apps, values(src_ip) AS src_ips, values(ua) AS user_agents, max(ioc_ip) AS matched_unc6671_ip, max(ioc_ua) AS matched_attacker_ua, min(_time) AS first_seen, max(_time) AS last_seen BY user
| eval first_seen=strftime(first_seen, "%F %T"), last_seen=strftime(last_seen, "%F %T")
| sort - successes
```

### Microsoft KQL

```kql
let unc6671_ips = dynamic(["31.7.56.61","31.7.56.52","193.34.212.132","185.178.208.153","23.234.75.84","195.140.213.114","195.140.213.115","107.128.45.122","76.103.148.180"]);
union isfuzzy=true SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(24h)
| where IPAddress in (unc6671_ips) or (UserAgent has "Firefox/146.0" and UserAgent has "Ubuntu")
| extend Outcome = iff(ResultType == "0", "Success", "Failure")
| summarize Events = count(), Successes = countif(Outcome == "Success"), Failures = countif(Outcome == "Failure"), Apps = make_set(AppDisplayName, 10), IPs = make_set(IPAddress, 10), UserAgents = make_set(UserAgent, 5), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by UserPrincipalName
| order by Successes desc
```

### Sigma

```yaml
title: Entra ID Sign-In From UNC6671 AiTM Proxy Infrastructure or Attacker User-Agent
id: 3f6c1a52-7b0e-4d8a-9c41-5e2a8d7b1c01
status: experimental
description: Detects Entra ID sign-ins originating from infrastructure reported by Google GTIG for UNC6671 (Falcon) adversary-in-the-middle reverse proxies, backends, exfiltration hosts and residential proxies, or from the Firefox 146 on Ubuntu user-agent seen in attacker sessions. A successful match indicates a replayed session after AiTM credential and token capture.
references:
    - 'https://cloud.google.com/blog/topics/threat-intelligence/unc6671-targets-financial-services-and-enterprise-cloud-environments'
    - 'https://www.ransomware.live/group/falcon'
    - 'https://www.ransomware.live/kql/view/78'
    - 'https://www.ransomware.live/kql/view/79'
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.initial-access
    - attack.t1078.004
    - attack.credential-access
    - attack.t1557
    - attack.t1539
    - attack.defense-evasion
    - attack.t1550.004
    - attack.command-and-control
    - attack.t1090.003
logsource:
    product: azure
    service: signinlogs
detection:
    selection_ip:
        IPAddress:
            - '31.7.56.61'
            - '31.7.56.52'
            - '193.34.212.132'
            - '185.178.208.153'
            - '23.234.75.84'
            - '195.140.213.114'
            - '195.140.213.115'
            - '107.128.45.122'
            - '76.103.148.180'
    selection_ua:
        UserAgent|contains|all:
            - 'Firefox/146.0'
            - 'X11; Ubuntu; Linux x86_64'
    condition: 1 of selection_*
falsepositives:
    - 'Legitimate Linux users running Firefox 146 on Ubuntu'
    - 'Residential proxy addresses 107.128.45.122 and 76.103.148.180 may be shared with unrelated AT&T or Comcast subscribers'
level: high

```

**Known false positives:**

- Legitimate Linux workstation users on Firefox 146 under Ubuntu
- Residential proxy IPs 107.128.45.122 and 76.103.148.180 are shared consumer addresses and may belong to benign users

**Tuning notes:** Treat the two residential proxy IPs as low-fidelity and weight matches on AiTM proxy IPs 31.7.56.61 and 31.7.56.52 higher. Allowlist known Ubuntu engineering users for the user-agent clause. Update the IP list from the GTIG report and the community-observed IOC set as it changes. Adjust the index and field names if the Splunk Add-on for Microsoft Cloud Services is configured differently.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- UNC6671 Falcon Passkey/SSO Lookalike Domain and AiTM Proxy Connections From Managed Endpoints (locked: unlock with TL Creds)
- UNC6671 Falcon Entra ID MFA Method Delete and Register (Helpdesk Vishing Takeover) (locked: unlock with TL Creds)
- UNC6671 Falcon Burst of SharePoint/OneDrive Downloads Following Risky Sign-In (AiTM to SaaS Exfil) (locked: unlock with TL Creds)
- UNC6671 Falcon AiTM Phishing Domain Access via Web Proxy (locked: unlock with TL Creds)
- UNC6671 Falcon Mailbox Cleanup of Security Alert and Password Reset Emails (locked: unlock with TL Creds)
- UNC6671 Falcon Exfiltration Host and Leak Site Network Connections (locked: unlock with TL Creds)
- UNC6671 Falcon Okta MFA Enrolment After Authentication Failures or Factor Removal (locked: unlock with TL Creds)
- UNC6671 Falcon SharePoint/OneDrive Bulk File Access via Scripting User-Agents (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 24)

Defanged, TLP:CLEAR.

- IP address: `31.7.56[.]61`
- Domain: `i7loab6thvz4lb7jdr3qoeumbvilwhbgnwsctnlfmvsv7g5s3vsiw6yd[.]onion`
- IP address: `31.7.56[.]52`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ransomware.live – Buchanan Ingersoll & Rooney PC (Falcon)](https://www.ransomware.live/id/QnVjaGFuYW4gSW5nZXJzb2xsICYgUm9vbmV5IFBDQEZhbGNvbg)
- [ransomware.live – Falcon group profile](https://www.ransomware.live/group/falcon)
- [Google Cloud / GTIG – UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments](https://cloud.google.com/blog/topics/threat-intelligence/unc6671-targets-financial-services-and-enterprise-cloud-environments)
- [The Hacker News – UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data](https://thehackernews.com/2026/08/unc6671-vishing-attacks-target-personal.html)
- [TechNadu – UNC6671 Rebrands BlackFile Into Redact, Pink, Helix, and Falcon Extortion Operations](https://www.technadu.com/google-links-unc6671-to-multiple-extortion-brands-after-blackfiles-apparent-retirement/633045/)
- [ransomware.live KQL 79 – Burst of M365 Downloads Following Risky Sign-In (AiTM to SaaS Exfil)](https://www.ransomware.live/kql/view/79)
- [ransomware.live KQL 78 – MFA Method Reset/Registration Change (Helpdesk Vishing Indicator)](https://www.ransomware.live/kql/view/78)
- [Breachsense – Weitz & Luxenberg data breach (Falcon)](https://www.breachsense.com/breaches/weitz-and-luxenberg-data-breach/)
- [Breachsense – Beasley Allen Law Firm data breach (Falcon)](https://www.breachsense.com/breaches/beasley-allen-law-firm-data-breach/)
- [dexpose – Falcon Ransomware Group Targets Globus Medical in Data Breach](https://www.dexpose.io/falcon-ransomware-group-targets-globus-medical-in-data-breach/)
- [dexpose – Falcon ransomware attack targets DistributionNOW Inc](https://www.dexpose.io/falcon-ransomware-attack-targets-distributionnow-inc/)
- [dexpose – Falcon Ransomware Group Targets Hayward Holdings](https://www.dexpose.io/?p=43441)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5191