Apr 09, 2026 • Ionut Arghire
Google Warns of New Campaign Targeting BPOs to Steal Corporate Data
Google's Threat Intelligence team has identified a new campaign, tracked as UNC6783, targeting Business Process Outsourcing (BPO) companies to steal corporate...
Executive Summary
Google's Threat Intelligence team has identified a new campaign, tracked as UNC6783, targeting Business Process Outsourcing (BPO) companies to steal corporate data. The threat actor is likely linked to Mr. Raccoon, a hacker associated with the alleged theft of Adobe customer data. BPOs represent high-value targets as they maintain sensitive data for multiple corporate clients, creating a single point of compromise that can yield access to numerous organizations. Organizations utilizing BPO services should immediately audit their third-party vendor relationships, enforce strict access controls, implement multi-factor authentication, and monitor for unusual data exfiltration patterns. Security teams should also review authentication logs for signs of credential compromise originating from BPO access points.
Summary
Tracked as UNC6783, the threat actor is likely linked to Mr. Raccoon, the hacker behind the alleged theft of Adobe data from a BPO. The post Google Warns of New Campaign Targeting BPOs to Steal Corporate Data appeared first on SecurityWeek .
Published Analysis
Google's Threat Intelligence team has identified a new campaign, tracked as UNC6783, targeting Business Process Outsourcing (BPO) companies to steal corporate data. The threat actor is likely linked to Mr. Raccoon, a hacker associated with the alleged theft of Adobe customer data. BPOs represent high-value targets as they maintain sensitive data for multiple corporate clients, creating a single point of compromise that can yield access to numerous organizations. Organizations utilizing BPO services should immediately audit their third-party vendor relationships, enforce strict access controls, implement multi-factor authentication, and monitor for unusual data exfiltration patterns. Security teams should also review authentication logs for signs of credential compromise originating from BPO access points. Tracked as UNC6783, the threat actor is likely linked to Mr. Raccoon, the hacker behind the alleged theft of Adobe data from a BPO. The post Google Warns of New Campaign Targeting BPOs to Steal Corporate Data appeared first on SecurityWeek . Tracked as UNC6783, the threat actor is likely linked to Mr. Raccoon, the hacker behind the alleged theft of Adobe data from a BPO. The post Google Warns of New Campaign Targeting BPOs to Steal Corporate Data appeared first on SecurityWeek .
Linked Entities
- Mr. Raccoon
- UNC6783