UNC6661
ObscureIQ Threat Intelligence · Actor Profile
UNC6661Confidence: Medium-High
Activity cluster · vendor activity cluster
Motivation: Financial
0Attributed Breaches
Medium-HighAttribution Confidence
Activity clusterActor Type
Overview
A vendor-style UNC activity cluster referenced in reporting on ShinyHunters-style SaaS data theft involving vishing, SSO credential theft, and SaaS exfiltration. Treat as an activity-tracking label rather than a named gang.
Tactics, Targeting & TTPs
Status: vendor tracking label. Related: ShinyHunters-style SaaS extortion.
Related Clusters & Actors
ShinyHunters
Source
Attribution draws on public threat-intelligence reporting · Established (multi-source). Primary source →
Were you exposed in one of these breaches?
Check your exposure privately, or request a tailored exposure audit.