UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

What Happened

A cybercriminal group called UNC6671 is tricking employees by phone, pretending to be IT helpdesk staff calling about urgent security updates. They call employees on their personal phones and direct them to fake login websites that steal both passwords and multi-factor authentication codes. Once inside, the group uses automated tools to steal large amounts of data from corporate cloud services like Microsoft 365 and Okta, then threatens to publish the stolen data unless a ransom is paid. The group operates under multiple brand names (BlackFile, Redact, Pink, Helix, and Falcon) to confuse investigators and hide how many victims they have. They have recently focused on targeting financial firms, private equity companies, and law firms, likely because these organizations hold sensitive deal and legal data. Organizations should switch to phishing-resistant authentication methods (like physical security keys), monitor for unusual cloud data access, and train employees to verify any unexpected IT support calls through official internal channels.

Key Takeaways

• UNC6671 continues active operations despite the alleged BlackFile retirement, now operating across five extortion brands: BlackFile, Redact, Pink, Helix, and Falcon.
• The group uses voice phishing (vishing) targeting employees on personal mobile devices, spoofing IT helpdesk numbers to lure victims to AiTM credential harvesting portals.
• Shared phishing infrastructure across all brands — identical templates hosted on passkey-themed root domains — strongly suggests a coordinated group rather than independent actors.
• Targeting has shifted toward financial services, private equity, law firms, and financial rating agencies, likely seeking high-value M&A and litigation data to maximize extortion leverage.
• GTIG reviewed 18 BlackFile Bitcoin wallets receiving 141.65 BTC (~$10.69M USD), with ransom payments continuing past the announced May 2026 shutdown.

Affected Systems

• Microsoft 365
• Okta
• Enterprise SSO environments (Entra ID, Okta)
• Non-SSO enterprise applications with independent password resets
• Employee personal mobile devices

Vulnerabilities (CVEs)

None identified.

Attack Chain

1. Initial Access: Vishing calls to employees on personal mobile devices, spoofing IT helpdesk numbers with pretext of urgent passkey/MFA enrollment
2. Credential Harvesting: Victims directed to AiTM phishing panels on passkey-themed domains (e.g., [company].createssopasskey.com) that intercept credentials and MFA tokens
3. Session Persistence: Stolen session tokens used to access Microsoft 365 and Okta without triggering re-authentication
4. Defense Evasion: Compromised email accounts used to reset passwords for non-SSO apps; security notifications, password-reset confirmations, and MFA change alerts systematically deleted
5. Exfiltration: Automated scripts using scripting libraries (python-requests, WindowsPowerShell, Go-http-client) exfiltrate data from SaaS applications at volumes exceeding human browsing thresholds
6. Extortion: Stolen data published on brand-specific DLS sites (BlackFile, Redact, Pink, Helix, Falcon) with ransom demands of $1M-$3M USD, often negotiated down to ~$750K

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: Yes
• Platforms: GTIG hardening guidance, Okta audit log queries, Microsoft Entra ID UAL telemetry queries

The article provides detection guidance in the form of log query patterns for Okta and Entra ID (monitoring for abandoned MFA challenge patterns and FileAccessed events with scripting-library UserAgent strings) and conditional access policy recommendations, but does not include formalized detection rules.

Detection Engineering Assessment

Required Log Sources

• Okta System Log (system.multifactor.factor.setup, user.authentication.auth_via_mfa events)
• Microsoft Entra ID audit logs and Unified Audit Log (UAL) FileAccessed events
• Microsoft 365 UAL with UserAgent string field
• DNS resolution logs or passive DNS
• Web proxy logs for outbound HTTP/HTTPS traffic
• Email gateway logs for password reset notification deletion patterns
• Conditional access policy evaluation logs

Hunting Hypotheses

Control Gaps

• Traditional email security gateways would not detect vishing calls to personal mobile devices
• Standard MFA (push notifications, OTP codes) is bypassed by AiTM proxies that relay tokens in real-time
• Conditional access policies based solely on IP geolocation may be bypassed via residential proxy services
• FileAccessed events in SaaS audit logs are often treated with lower priority than FileDownloaded, missing automated exfiltration via scripting libraries that access but may not trigger download events
• Password reset notification deletion within compromised mailboxes may not trigger alerts if email deletion auditing is not configured
• Session token theft is not detected by traditional endpoint security since no malware is executed on the victim device

Key Behavioral Indicators

• MFA factor enrollment event immediately preceded by authentication failure or abandoned push challenge (Okta: system.multifactor.factor.setup after user.authentication.auth_via_mfa)
• FileAccessed events with UserAgent strings identifying scripting libraries: python-requests, WindowsPowerShell, Go-http-client
• High-volume file access in Microsoft 365 exceeding normal human browsing thresholds within a single session
• DNS resolution to recently registered domains containing keywords: passkey, sso, mfa, okta combined with victim-specific subdomains
• Sequential email deletion events targeting security notifications, password-reset confirmations, and MFA configuration alerts within a short time window
• SSO authentication from commercial VPN providers (Mullvad, Private Layer) or residential broadband IPs diverging from employee geographic baselines
• Password reset events for non-SSO enterprise applications initiated from a recently compromised account

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Consider enforcing phishing-resistant MFA (FIDO2 security keys, platform authenticators like Windows Hello for Business or Okta Fastpass) across all SSO and IdP environments, as WebAuthn cryptographic origin binding renders AiTM proxies ineffective.
• Evaluate whether integrating all business-critical SaaS applications with a central SSO platform (Entra ID or Okta) would reduce configuration drift and enable consistent security policy enforcement.
• Consider reducing session token lifetimes to enforce re-authentication at least once per work day, with shorter idle timeouts for privileged access, and evaluate token theft mitigations such as IP session binding, Device-Bound Session Credentials, or Continuous Access Evaluation.
• If supported by your IdP, consider implementing conditional access policies restricting authentication to trusted network sources (corporate networks, VPN ranges, SASE platforms) and requiring corporate-managed devices with MDM and EDR for access.
• Consider deploying credential guarding tools such as Google Workspace Password Alert or Microsoft Defender SmartScreen Credential Protection to block credential submissions on unverified sites.

User Protection

• Consider training employees to verify any IT support calls — especially those received on personal mobile devices — by hanging up and contacting IT through verified internal channels.
• If applicable, consider deploying corporate-managed mobile device profiles that can help identify or block spoofed caller IDs used in vishing attempts.
• Consider educating employees on the legitimate passkey/MFA enrollment process so they can recognize when a caller's instructions deviate from standard procedures.

Security Awareness

• Consider incorporating vishing scenario training into existing security awareness programs, specifically covering IT helpdesk impersonation and urgent MFA/passkey enrollment pretexts.
• Consider rolling out guidance to employees that legitimate IT staff will never ask them to visit a third-party website to enroll passkeys or reset MFA, and that security migrations are communicated through official internal channels.
• If your organization is in financial services, private equity, legal, or professional services, consider elevating awareness training priority given UNC6671's recent targeting shift toward these sectors.

MITRE ATT&CK Mapping

Additional IOCs

• Domains:
  • mysecurepasskey[.]com - AiTM credential harvesting root domain used as intermediate bridge to passkeydeploy.com (Pink); also linked from passkeyuser.com (BlackFile)
  • passkeyms[.]com - AiTM credential harvesting root domain used to target unlisted companies; acted as intermediate bridge to passkeydeploy.com (Pink)
  • passkeyportal[.]com - AiTM credential harvesting root domain linked from passkeyuser.com (BlackFile) intermediate targets; associated with Helix brand
• Command Lines:
  • Purpose: Automated SaaS data exfiltration from Microsoft 365 and Okta using scripting libraries after session persistence established | Tools: python-requests, WindowsPowerShell, Go-http-client | Stage: Exfiltration