Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Data Is the New Diamond: Heists in the Digital Age

Summary: Unit 42 draws a parallel between the February 2003 Antwerp Diamond Centre heist, in which five criminals stole more than $100 million in diamonds and jewelry after mastermind Leonardo Notarbartolo used reconnaissance and social engineering, and a data theft extortion campaign reported by Google in June 2025 that compromises Salesforce instances via vishing, internal reconnaissance and exfiltration. Unit 42 attributes initial access and data theft to UNC6040 and the extortion to Bling Libra (aka ShinyHunters), says the activity has likely run since at least December 2024 against aviation, financial services, technology and retail firms, and notes that 23% of its incident response cases involving social engineering as initial access used callback or voice-based techniques.

What's compelling: These actors leave little digital evidence because they use no malware or custom tools, so the perimeter controls most organizations rely on have nothing to detect. Bling Libra remained active even after French authorities announced the arrest of four alleged members in June 2025, and the retail targets are primarily sellers of high-end jewelry, apparel and accessories.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Phishing & Social Engineering
Related