Threat ActorPublished 7 Aug 2026

Vishing Extortion Group UNC6671 Rebrands After Making Millions

Source SecurityWeek

Description

Initially calling itself BlackFile, the group has expanded operations to the Redact, Pink, Helix, and Falcon brands. The post Vishing Extortion Group UNC6671 Rebrands After Making Millions appeared first on SecurityWeek .

Impact

The group has successfully compromised numerous organizations across multiple sectors, gaining unauthorized access to cloud environments by bypassing multi-factor authentication. Their extortion campaigns have resulted in ransom payments totaling over $10 million in Bitcoin. The attacks can lead to significant financial loss, data compromise, and operational disruption for targeted organizations. The use of sophisticated techniques to evade detection increases the risk and potential impact of their campaigns.

Defensive guidance

Organizations should be aware of UNC6671's tactics, including vishing calls impersonating IT helpdesk staff and the use of spoofed login portals. Security teams should educate employees about these social engineering tactics and verify any unsolicited IT helpdesk communications through independent channels. Monitoring for suspicious login attempts and unusual password resets, especially for cloud services like Microsoft 365 and Okta, is recommended. Implementing strong identity verification processes for helpdesk interactions and promptly investigating any alerts of credential compromise can help mitigate risk. Vendor advisories or official guidance from cloud service providers should be consulted for additional protective measures.

Summary

UNC6671 is a threat actor group specializing in tailored IT helpdesk voice phishing (vishing) extortion campaigns. The group initially operated under the BlackFile brand but has diversified into multiple brands such as Redact, Pink, Helix, and Falcon. Their attacks leverage adversary-in-the-middle techniques to bypass multi-factor authentication and compromise cloud services like Microsoft 365 and Okta. UNC6671 uses spoofed login portals and phone numbers to trick employees into divulging credentials and MFA tokens. They have targeted organizations mainly in North America, Australia, and the UK, focusing on sectors with sensitive information. The group has received over $10 million in ransom payments and continues to adapt its tactics, including using compromised email accounts to reset passwords and deleting notifications to avoid detection. Their infrastructure includes multiple generic root domains and victim-specific subdomains for credential harvesting.

References

securityweek.com/vishing-extortion-group-unc6671-rebrands-after-making-millions/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 7 Aug 2026, 11:11 UTC

References

Community reviews