UNC6671, also known as Cordial Spider, has been running an adversary-in-the-middle (AitM) operation since April, targeting financial services and other industries under brands like Falcon, Helix, Pink, Redact, and BlackFile. They use a custom console called Work Panel for credential relay and have collected over $8 million in payments.