A New Name in the Data Extortion Ecosystem?
A data extortion group called Helix has been identified conducting multi-target campaigns using vishing, device code phishing, and automated SharePoint exfiltration. The group likely emerged from the BlackFile and ShinyHunters ecosystem after BlackFile shut down in April 2026. Helix uses sophisticated social engineering, impersonating managers by name during vishing calls to initiate device code authentication flows. The operation employs shared infrastructure including phishing domains registered through NICENIC with target-specific subdomains. After gaining access, attackers register MFA on compromised accounts, enumerate SharePoint using automated tools with python-requests user-agent, and conduct bulk data exfiltration. Infrastructure analysis reveals connections to BlackFile through hosting on the same autonomous system. The group demonstrates operational flexibility with varying dwell times and uses residential proxies geo-matched to targets to evade detection.
Indicators of Compromise
- ip: 179.43.185.226
- ip: 179.43.185.230
- domain: oskeysync.com
- ip: 179.43.171.42
A New Name in the Data Extortion Ecosystem?
Description
A data extortion group called Helix has been identified conducting multi-target campaigns using vishing, device code phishing, and automated SharePoint exfiltration. The group likely emerged from the BlackFile and ShinyHunters ecosystem after BlackFile shut down in April 2026. Helix uses sophisticated social engineering, impersonating managers by name during vishing calls to initiate device code authentication flows. The operation employs shared infrastructure including phishing domains registered through NICENIC with target-specific subdomains. After gaining access, attackers register MFA on compromised accounts, enumerate SharePoint using automated tools with python-requests user-agent, and conduct bulk data exfiltration. Infrastructure analysis reveals connections to BlackFile through hosting on the same autonomous system. The group demonstrates operational flexibility with varying dwell times and uses residential proxies geo-matched to targets to evade detection.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://reliaquest.com/blog/threat-spotlight-helix-new-name-in-data-extortion-ecosystem"]
- Adversary
- Helix
- Pulse Id
- 6a623272a8b581c080b0aee0
- Threat Score
- null
Indicators of Compromise
Ip
| Value | Description | Copy |
|---|---|---|
ip179.43.185.226 | CC=CH ASN=AS51852 private layer inc | |
ip179.43.185.230 | CC=CH ASN=AS51852 private layer inc | |
ip179.43.171.42 | CC=CH ASN=AS51852 private layer inc |
Domain
| Value | Description | Copy |
|---|---|---|
domainoskeysync.com | — |
Threat ID: 6a6235339c2644c7f84c7441
Added to database: 07/23/2026, 15:37:23 UTC
Last enriched: 08/23/2026, 10:53:13 UTC
Last updated: 09/05/2026, 15:39:22 UTC
Views: 281
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.