UNC6671 kept operating after BlackFile's announced retirement, across four further extortion brands — and its vishing pretext is now an urgent order to enroll a FIDO2 passkey
The retirement of a ransomware brand is a press release, not an outcome. Google Threat Intelligence Group reports that UNC6671, the actor behind the BlackFile extortion brand whose shutdown was announced in May 2026, went on operating and diversified across four further extortion fronts — Redact, Pink, Helix and Falcon — with the intrusion tradecraft essentially untouched (GTIG / Mandiant, 2026-08-06). The linkage is an assessment rather than a certainty, and GTIG says so: overlapping victim targeting across brands "support our assessment that a common group of threat actors are affiliated with the BlackFile, Redact, Pink, Helix, and Falcon extortion brands, although other scenarios such as splintered affiliates or shared Phishing-as-a-Service infrastructure may also be plausible" (GTIG / Mandiant, 2026-08-06). The evidentiary basis is infrastructure economics: rather than isolating infrastructure per victim, the operator reuses generic root domains across many targets and appends victim-name subdomains, so one root domain used against a Falcon-extorted organisation was simultaneously used against a Helix-extorted one — and the same phishing templates, identical in code and design, were served from several of those domains at once.
The lure is the important change, and it inverts the standard advice. The pretext is an urgent helpdesk mandate to enable FIDO2 passkeys or update MFA enrolment, delivered by a caller who reaches the employee on their personal mobile — GTIG records that "UNC6671 callers have continued to call targeted employees on their personal mobile numbers, circumventing corporate security controls", and that "in at least some recent cases, the threat actor has spoofed the legitimate helpdesk phone number adding an air of legitimacy" (GTIG / Mandiant, 2026-08-06). Root domains pair authentication vocabulary — passkey, mfa, sso — with a verb, so the destination reads as an enrolment portal. GTIG's own hardening guidance names phishing-resistant authenticators as the durable control, because "these authenticators implement WebAuthn standard to enforce cryptographic origin binding between the authenticator and the specific domains it can authenticate to, rendering lookalike domains and AiTM proxies ineffective" (GTIG / Mandiant, 2026-08-06). The operational catch is that origin binding protects an authenticator that already exists; this actor attacks the moment one is created. A defender who has deployed passkeys and considers the identity problem closed has hardened the authentication step and left the enrolment step as the way in.
Post-compromise, the chain is deliberately quiet. With session persistence established, the operator uses compromised mailboxes to trigger password resets on non-SSO enterprise applications, then blinds the victim: GTIG records that "operators systematically deleted password-reset confirmations, secondary security notifications, company-wide security alerts, and any alerts generated during modifications to account security or MFA configurations" (GTIG / Mandiant, 2026-08-06). Exfiltration is scripted rather than hands-on-keyboard, pulling data from Microsoft 365 and other SaaS stores at machine rates. GTIG characterises the operation as data-theft extortion throughout and no cited source describes an encryption stage; the leverage on the evidence published is publication.
Targeting has moved deliberately upmarket. Between April and May 2026 the domains were aimed broadly at large enterprises in manufacturing, real estate, healthcare and insurance; in June the focus shifted to technology, transportation and hospitality; and "by July 2026, the target profile narrowed to focus on the financial and legal sectors, with observed infrastructure directed at private equity firms, law firms, and financial rating agencies" (GTIG / Mandiant, 2026-08-06) — organisations holding merger, capital-deployment and litigation material, which is leverage rather than data. Operational tempo rose with it, to "an accelerated cadence of approximately one domain every 1.6 days" across June and July against one every 2.2 days in the preceding two months (GTIG / Mandiant, 2026-08-06). BleepingComputer, relaying Reuters and Bloomberg, reports that recent targets in this financial-sector phase include several large US hedge funds and private-equity firms; GTIG names no victims itself (BleepingComputer, 2026-08-06).
The economics explain why announced retirements mean nothing. GTIG reviewed 18 BlackFile Bitcoin wallet addresses receiving 141.65 BTC — roughly $10.69 million at transaction time — between 2026-01-07 and 2026-05-12, with payments continuing past the 2026-05-11 shutdown notice and significant cash-out events in late April and early May. Initial demands run from $1 million to upwards of $3 million, negotiated down by 50% to 75%, and "in over 53% of tracked cases in this timeframe, final payments averaged $750,000 USD (~10.2 BTC)" (GTIG / Mandiant, 2026-08-06). GTIG's read is that the multi-brand structure most likely compartmentalises operations, hides total breach volume and isolates negotiation fallout — which is why brand-based tracking misleads and TTP-based tracking does not.
These overlaps support our assessment that a common group of threat actors are affiliated with the BlackFile, Redact, Pink, Helix, and Falcon extortion brands, although other scenarios such as splintered affiliates or shared Phishing-as-a-Service infrastructure may also be plausible.
UNC6671 callers have continued to call targeted employees on their personal mobile numbers, circumventing corporate security controls.
In at least some recent cases, the threat actor has spoofed the legitimate helpdesk phone number adding an air of legitimacy.
operators systematically deleted password-reset confirmations, secondary security notifications, company-wide security alerts, and any alerts generated during modifications to account security or MFA configurations.
In over 53% of tracked cases in this timeframe, final payments averaged $750,000 USD (~10.2 BTC).
These authenticators implement WebAuthn standard to enforce cryptographic origin binding between the authenticator and the specific domains it can authenticate to, rendering lookalike domains and AiTM proxies ineffective.
Defender actions
- Gate new authenticator and passkey enrolment behind out-of-band identity proofing that does not run over the phone channel the request arrives on — this actor's entire initial access depends on an employee completing an enrolment during an unsolicited call, and origin-bound FIDO2 does not defend the enrolment step itself.
ATT&CK mapping
14 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Reconnaissance TA0043
T1598.004Phishing for Information: Spearphishing Voice
Adversaries may use voice communications to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient.
Initial Access TA0001
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
T1566.004Phishing: Spearphishing Voice
Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient.
Persistence TA0003
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
T1098.005Account Manipulation: Device Registration
Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.
T1556.006Modify Authentication Process: Multi-Factor Authentication
Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
Privilege Escalation TA0004
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
T1098.005Account Manipulation: Device Registration
Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.
Stealth TA0005
T1070.008Indicator Removal: Clear Mailbox Data
Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests.
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
T1684.001Social Engineering: Impersonation
Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims.
Defense Impairment TA0112
T1556.006Modify Authentication Process: Multi-Factor Authentication
Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
Credential Access TA0006
T1556.006Modify Authentication Process: Multi-Factor Authentication
Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
T1557Adversary-in-the-Middle
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.
T1621Multi-Factor Authentication Request Generation
Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.
Collection TA0009
T1114.002Email Collection: Remote Email Collection
Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as MailSniper can be used to automate searches for specific keywords.
T1213.002Data from Information Repositories: Sharepoint
Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint:
T1530Data from Cloud Storage
Adversaries may access data from cloud storage.
T1557Adversary-in-the-Middle
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.
Command and Control TA0011
T1090.002Proxy: External Proxy
Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion.
Impact TA0040
T1657Financial Theft
Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware, business email compromise (BEC) and fraud, "pig butchering," bank hacking, and exploiting cryptocurrency networks.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.