grep -rl "extortion" ./articles
UNC6671 runs four extortion brands off one set of domains. The pretext is a security upgrade — FIDO2 enrolment, MFA migration — and the payoff is an adversary-in-the-middle portal. Average settled payment: $750,000.
Two law firms, an equine hospital, a mental health charity and three metal companies, published in batches with a two-day gap between attack and leak. It shares a name with Microsoft's Storm-1175, which is a different actor entirely.
Microsoft's analysis describes two Polygon wallet addresses holding proxy URLs and leak-blog posts, with negotiation over Session. There is no hosting provider to serve, because there is no hosting.
Attack volume jumped nearly 20% month over month. Qilin alone accounted for 372 incidents across Europe, hitting 26 of 31 countries analyzed.