The World's Biggest Private Equity Firms Are Getting Hit By Phone Calls

The world's largest alternative asset managers — Blackstone, Apollo, KKR, Bain, TPG, Bridgewater — were recently targeted in a ransomware campaign that bypassed their entire security stack by having someone pick up their personal cell phone.

That's the mechanism. Not a zero-day exploit. Not a supply chain breach in a critical software library. A person in another country calls your employee, spoofs the IT helpdesk number on caller ID, says there's an urgent directive to update passkeys, and asks them to go to passkeyhelpdesk[.]com and enter their password. If the employee does — and apparently some do — the hackers get the MFA code in real time over the phone and walk in.

Google's threat intelligence team identified 72 malicious websites the group set up, each with firm-specific subdomains that made the thing look legitimate enough for the trick to work. The group — tracked as UNC6671, recently rebranded from BlackFile to Redact, also operating under the names Pink, Helix, and Falcon — has been running this campaign against roughly 200 organizations for about five weeks. From January to May, they pulled in $10.7 million in Bitcoin. Some unnamed victims paid ransoms. It's unclear whether any of the private equity firms were actually breached.

Reuters could not confirm that. No company confirmed that. All of them declined to comment. The attack is real, the targeting is real, the success rate is not.

The stock headline pretends this matters more than it does

The reporting circulated on August 6 and by August 7 the business press was running the angle: BX, APO, KKR all "wobble" after the hacker report surfaces. Blackstone fell 1.9% on the day. Apollo fell 1.3%. KKR fell 2.2%. The move was attributed to the threat.

The thing is, these stocks don't wobble because of a vague unconfirmed phishing campaign. They've been falling all year for reasons that actually move the numbers.

Blackstone is down 13.4% year-to-date, its rolling annual return is -21.8%, and it's trading at $133, more than $55 below its 52-week high of $190. KKR is down 19% YTD with a rolling annual return of -27.6% and sits at $103, well below its $152 high. Apollo is down 11.6% YTD. None of these firms are having a good 2026. The "wobble" is a Tuesday rounding error on a much larger decline driven by rate sensitivity, deal flow uncertainty, valuation pressure on illiquid assets, and — in Blackstone's case specifically — earnings that have missed expectations and margin pressure from shifting management fee dynamics.

The hacker report just landed on a day when the stocks were already moving down. That's how market stories work.

The real weird thing is the interface

But let's set the stock framing aside for a minute and look at the actual mechanism, because the attack itself is genuinely interesting from a plumbing perspective.

These are among the most heavily resourced, compliance-obsessed, security-audited financial institutions in the United States. They manage trillions of dollars in illiquid assets. They have dedicated cybersecurity teams, managed detection and response platforms, endpoint monitoring, SIEM systems, and presumably policies about not clicking unknown links. And the thing getting past all of that is someone calling people on their personal phones.

That's the interface failure. The corporate security stack ends at the boundary where an employee's personal device meets a phone call from a person who sounds helpful and is asking them to do something their company actually told them to do — update passkeys, a genuine security initiative — but on a fake site.

The hackers aren't sophisticated in the traditional sense. Google's own analysts described the tactics as "low-tech" and "really effective." They're using Adversary-in-the-Middle infrastructure — basically a proxy that sits between the victim and the fake login page, intercepting credentials and MFA tokens live — but the technical sophistication is standard phishing 2026. The edge is in the social engineering: spoofing caller ID to show the real helpdesk number, targeting personal phones where corporate endpoint detection doesn't run, and asking for exactly what the victim is already primed to provide.

The group has shifted its focus over the summer, too. April through May it hit manufacturing, real estate, healthcare, and insurance. June moved to technology and hospitality. July narrowed to financial firms, law firms, and credit rating agencies — organizations where stolen data generates maximum ransom leverage. The targeting of private equity makes sense from the extortion business model: these firms sit on deal terms, portfolio company data, sensitive M&A information, and client identities. All of it is the kind of stuff that makes a firm pay.

What actually protects you from this

The fix isn't another layer of technology. It's removing the interface the hackers are exploiting. Enforce FIDO2 passkeys that can't be phished — real hardware-based or properly bound passkeys, not the ones that still let a live operator talk you through typing in a code. Require that all security updates happen through corporate-managed endpoints, not personal phones. Integrate single sign-on so employees can't be tricked into resetting passwords on side applications. Delete the channel that connects a stranger's voice to your credentials.

Google's threat blog basically says the same thing, though with more jargon: use phishing-resistant authenticators, enforce session controls, restrict authentication to trusted network sources.

The economic point is that for all the money these firms spend on cybersecurity — and they certainly spend it — the vulnerability isn't in the systems. It's in the assumption that the human endpoint is as secure as the corporate network. It's not. Humans are not a security control.

Who actually cares

So yes, the stocks dipped. The hacker report is a real story about a real campaign targeting real firms with a real financial motive. But the move in the shares has nothing to do with the attack. The attack is a Tuesday. The stock decline is a year.

The structural implication for investors in these names isn't whether some ransomware group phished a helpdesk number. It's whether the firms can maintain fee revenue and asset valuations when the macro environment keeps making private capital look like it's been overpriced since early 2025. The hackers are just another cost of doing business at scale — the cost of having 10,000 employees, each one carrying a device that can reach your Microsoft 365 tenant, and each one occasionally answering an unfamiliar call.

That's the weird part. The most complex, well-funded financial organizations in the country have a $10 million annual security budget and their weakest point is an employee named Dave who got a phone call.