Attributed metadata history
Up to 100 retained publisher events per page for 7d2e2c4d5abe0f3b2437659f2ab71fa2e19d62ed45ed4eca1e64280d68906773. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_029e2f07006b78ebcb
observed · 2026-10-12 05:29:01 UTC
Written by: Tyler McLellan, Austin Larsen Introduction Google Threat Intelligence Group (GTIG) continues to track UNC6671 actively conducting compromises leading to data theft extortion, despite the alleged announced retirement of the BlackFile extortion brand in May 2026. Telemetry and infrastructure analysis reveal that rather than disbanding, UNC6671 has diversified its operations across multiple extortion fronts including Redact, Pink, Helix, and Falcon. UNC6671 continues to rely on voice phishing (vishing) to target enterprise employees, posing as IT helpdesk staff facilitating mandatory, urgent security migrations. Significantly, the threat actor often contacts employees via their personal mobile devices. These calls lure victims to spoofed login portals where Adversary-in-the-Middle (AiTM) infrastructure intercepts credentials and multi-factor authentication (MFA) tokens. Once session persistence is established, the actors deploy automated scripts for data exfiltration from enterprise cloud environments, including Microsoft 365 and Okta. In this update to our May 2026 blog, we detail the infrastructure linkages connecting these extortion brands. We also examine the evolut
Fingerprint: 100febbf5bca3b323e213edbc67349b74ff4c05845281bb5135540ae77a049f6
intelligence_src_029e2f07006b78ebcb
observed · 2026-10-12 05:29:01 UTC
available
Fingerprint: e71aa6d523741f9f527f5071fd96527dbb781bc01e36c89fd9ec28cdb29f734f