UNC6671

'Helix' data-extortion cluster pairs manager-impersonation vishing with device-code phishing and automated SharePoint exfiltration

ReliaQuest's Threat Research team published (2026-07-08) a spotlight on Helix, a data-extortion cluster it assesses as a likely continuation of the now-fragmented BlackFile (UNC6671) operation and the broader ShinyHunters ecosystem — an assessment resting on a shared credential-harvesting-domain registrar (also used by the Scattered Spider/"The Com" community) and an exfiltration host four addresses away, on the same autonomous system, from a confirmed BlackFile address two months earlier (ReliaQuest, 2026-07-08). ReliaQuest is explicit that this is likely-ecosystem-continuation, not confirmed attribution — but "organizations already tracking those groups should treat Helix as an extension of the same data extortion campaigns."

The device-code-phishing-defeats-Conditional-Access primitive itself was covered earlier today in the Huntress Railway/LSHIY analysis (see references); Helix's contribution is the full extortion kill chain wrapped around it. Initial contact is voice phishing in which the operator impersonates the target's actual manager by name on a spoofed caller-ID and talks them through entering a device code into Chrome — the session token is captured without any password crossing the phone line, and the device-code flow bypasses Conditional Access (ReliaQuest, 2026-07-08; BleepingComputer, 2026-07-09). Persistence is deliberately minimal and hard to spot: the operator registers a new MFA Authenticator on the account, typically within minutes of sign-in, from the same residential proxy used for access — "the only persistence artifact is a legitimate MFA registration." Sign-in infrastructure is geo-matched to the target's real city to avoid impossible-travel alerts, rotating through 15+ residential IPs against a single mailbox. Collection is automated and identical across incidents — the operator issues contentclass:STS_Site and wildcard SharePoint searches to inventory reachable content, then bulk-downloads, using a python-requests user-agent from an IP reserved for exfiltration and never used for access. Dwell before mass exfil ranged from under an hour to over a week, a deliberate tuning to each environment's value and detectability. In at least one case the operator actively tested containment after the account was disabled, re-attempting MFA registration and a password reset.

Builds on: 2026-07-10/m365-conditional-access-gaps-railway-lshiy-campaigns

UNC6671 / BlackFile — GTIG publishes the full profile; group announced shutdown "under this name", rebrand probable

Resolving a W21 carry-forward watch item: GTIG published a definitive UNC6671 / BlackFile profile in mid-May 2026, characterising the operation as an adversary-in-the-middle vishing specialist targeting Microsoft 365 and Okta SSO environments in retail and hospitality (vishing impersonating IT support → MFA-bypass / credential grant → AiTM session-token harvest → exfiltration → extortion over the Session messenger). The leak-site went offline in late April, briefly resumed on 2026-05-11 to announce "BlackFile is shutting down… under this name," and went dark again — GTIG's phrasing and the qualifier point to a probable rebrand rather than a genuine exit. Defenders should keep the AiTM-vishing → rogue-MFA → SSO-token-theft TTP set on watch under any new brand; the tradecraft, not the name, is the durable indicator.

Looking ahead — 2026-W21

Items already in motion at the close of 2026-W21. Not predictions — each links to the in-motion reporting underneath.

• GitHub's fuller post-incident report on the internal-repo breach is still outstanding. GitHub's 2026-05-20 blog committed to a fuller report; the open questions are the full scope of the ~3,800 exfiltrated internal repos and whether any contained credentials or customer-impacting material. (GitHub Security Blog)
• Shai-Hulud wave-6 candidate registries — Cargo (Rust) and Maven (Java). The OIDC-token-reuse propagation primitive is registry-agnostic; with the worm now open-sourced and commoditised, Cargo and Maven are the un-hit major ecosystems. Pre-stage Sigstore/provenance-anomaly hunts in Rust and Java dependency pipelines. (CSA research note)
• EU 20th-package "managed security services" scope guidance, and SECO confirmation of Swiss transposition. No European Commission interpretive guidance on the managed-security-services definition was published as of 24 May; SECO confirmation of whether Switzerland's 22 May adoption includes the MSS prohibition specifically is the open compliance question for CH providers. (Greenberg Traurig)
• PAN-OS CVE-2026-0300 wave-2 patch builds scheduled ~2026-05-28. Remaining build streams finish the staged patch arc; audit for attacker-created rogue admin accounts before patching wipes implant artefacts. (Palo Alto PSIRT; daily 2026-05-18)
• Windows YellowKey / GreenPlasma / MiniPlasma cluster — June 2026 Patch Tuesday (~2026-06-10) is the expected first fix. Three public PoCs, no out-of-band release; until then BitLocker PIN/Network-Unlock GPOs and ctfmon.exe-injection WDAC rules are the only controls. (MSRC CVE-2026-45585; daily 2026-05-20)
• Sparx Enterprise Architect chain and ChromaDB CVE-2026-45829 remain unpatched. Both carry public PoCs with no vendor fix; watch for the patches and, in the interim, keep both off the public internet behind authenticated access. (CERT-PL; daily 2026-05-21)
• GTIG UNC6671 "BlackFile" probable rebrand. The DLS went offline with a shutdown message; no successor brand had emerged by week-end. Watch for a new leak-site reusing the vishing → AiTM → rogue-MFA → SharePoint-exfiltration TTP set. (daily 2026-05-23)