Threat actors have directed a significant extortion campaign at hedge funds, private equity firms and related financial services organizations in recent days, according to multiple reports made directly to Akin’s cybersecurity and privacy team and published by sources such as Bloomberg and the Google Threat Intelligence Group (GTIG).

The criminal actors, originally branded as Blackfile, are now using various monikers, including “Cordial Spider,” “Pink” and “Redact.” Their typical methods involve voice-initiated contact (“vishing”), often impersonating help desk personnel, with the aim of directing employees to a credential-harvesting page that mimics the victim’s own web pages. According to GTIG, the criminal group often initially contacts employees via their personal mobile phones. Once credentials have been acquired, the attackers use them to log in to data storage systems and extract sensitive information, which they then use to extort victims with seven-figure demands.

Akin understands these campaigns have been used successfully against at least 20 firms as of this alert.

What Firms Can Do Now

• Remind all employees and contractors to be on high alert for vishing attacks. These voice scams have become highly sophisticated and realistic.
• Prepare for investigations in the event of a successful attack by reviewing the firm’s Incident Response Plan (IRP) and preserving all communications and logging data associated with the incident.  
  • Under SEC Regulation S-P (Final Rule 34-10015), many investment firms are required to adopt written incident response policies and procedures (IRPs), including maintaining records relating to incident investigations that demonstrate adherence to the IRP. Firms should be prepared to consult and follow their IRP during an incident.
• Involve counsel early in an incident to engage forensic vendors and maximize opportunities to preserve attorney-client privilege. Experienced counsel may also have access to benchmarking and can help guide extortion negotiations.
• If an incident results in unauthorized access to sensitive customer information, a covered institution may be required to notify affected individuals, as detailed in 17 CFR § 248.30, for example. Putting customer notification protocols in place now can save valuable time later.

Next Steps

Phishing and vishing incidents can often be avoided through vigilant firm-wide education programs and a culture that is alert to threats and mindful of protecting sensitive customer information. Effective internal training should extend not only to frontline personnel but also to the boardroom.

For additional reading on this topic, see Akin’s recent alerts: https://www.akingump.com/en/insights/the-2026-directors-agenda-a-review-of-risks-and-opportunities-for-corporate-directors

https://www.akingump.com/en/insights/articles/cybersecurity-and-operational-resilience-a-board-level-imperative