Hacker Group Targets Blackstone, Apollo, Other US Financial Firms in Voice Phishing and Extortion Campaign

Over the past month, a hacking group has targeted dozens of prominent US financial institutions and other companies, including private equity firms and rating agencies such as Blackstone, Bridgewater Associates, Apollo Global Management, Bain Capital, KKR, TPG, CME Group and Moody's. The group carried out its attacks over the phone and built phishing websites designed to steal employee passwords, ultimately demanding ransom payments. In some cases, companies have already paid the hackers.

The hacking group operates under multiple names, including Redact, Pink, Falcon and Helix.

The hackers used a voice phishing approach, calling employees directly on their personal mobile phones while impersonating colleagues from the same floor or IT help desk technicians, tricking targets into entering account credentials and multi-factor authentication codes on forged phishing websites. After gaining access, some of the groups post the victim companies' data on dedicated extortion websites, demanding ransoms by threatening to leak the information. Previously, these groups focused mainly on the manufacturing, real estate, healthcare, insurance, technology, transportation and accommodation sectors, aiming to steal intellectual property, software source code or high-net-worth client data. More recently, the focus has shifted to private equity firms, law firms and credit rating agencies, seeking to maximize extortion leverage by obtaining highly valuable confidential business data related to mergers and acquisitions, capital deployment and litigation processes.

Statistics show that in the first few months of 2026 alone, cryptocurrency wallets linked to one of the hacker groups have received about $10 million worth of Bike coin. Individual ransom demands to victim organizations typically range from $750,000 to $3 million. A spokesperson for CME Group declined to comment on the report, while the other affected institutions have not yet responded.