Welcome to BlackFile: Inside a Vishing Extortion Operation

What Happened

A cybercriminal group known as BlackFile is calling employees on their personal phones, pretending to be IT support, to steal their login credentials. By tricking employees into handing over security codes, the attackers bypass multi-factor authentication and gain access to company systems like Microsoft 365. Once inside, they use automated programs to quickly steal massive amounts of sensitive company data and then demand a ransom, threatening to release the data or harass employees if unpaid. Organizations should train employees on these phone-based scams and upgrade to stronger, phishing-resistant security keys.

Key Takeaways

• UNC6671 (BlackFile) uses vishing and AiTM techniques to bypass traditional MFA and compromise SSO environments like Microsoft 365 and Okta.
• Upon gaining access, threat actors immediately register a new, attacker-controlled MFA device to establish persistence.
• Data exfiltration is highly automated using Python and PowerShell scripts, often masking activity as routine 'FileAccessed' events rather than 'FileDownloaded'.
• Extortion tactics are aggressive, including spamming employee mailboxes, threatening voicemails to executives, and swatting company personnel.
• Although the BlackFile Data Leak Site (DLS) recently announced a shutdown, the group's cloud-centric data theft techniques remain a significant ongoing threat.

Affected Systems

• Microsoft 365
• Okta
• SharePoint
• OneDrive
• Salesforce
• Zendesk
• Entra ID

Attack Chain

UNC6671 initiates attacks via vishing, contacting employees on personal phones under the guise of IT support to direct them to lookalike SSO portals. Using real-time adversary-in-the-middle (AiTM) techniques, the actors capture credentials and MFA codes to authenticate and immediately register a new attacker-controlled MFA device for persistence. The actors then utilize automated Python and PowerShell scripts to rapidly exfiltrate data from SaaS applications like SharePoint and OneDrive via direct API calls. Finally, the group launches aggressive extortion campaigns using Tox, Session, and hijacked internal email accounts, threatening data publication and employing harassment tactics like swatting.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: Yes
• Platforms: Google Security Operations (SecOps)

Google SecOps provides broad category rules under the Okta and O365 rule packs to detect the behaviors outlined, such as suspicious Okta admin actions and high-volume SharePoint file access.

Detection Engineering Assessment

EDR Visibility: Low — The attack primarily targets cloud SaaS environments (M365, Okta) and utilizes legitimate APIs for exfiltration, bypassing traditional endpoint telemetry. Network Visibility: Low — Traffic is encrypted and occurs directly between the threat actor's infrastructure and the cloud provider's APIs, not traversing the corporate network. Detection Difficulty: Moderate — Requires correlating identity provider logs with SaaS audit logs, specifically looking for anomalous MFA registrations and high-volume 'FileAccessed' events from scripting user agents.

Required Log Sources

• Microsoft 365 Unified Audit Log (UAL)
• Okta System Logs
• Identity Provider (IdP) Logs

Hunting Hypotheses

Control Gaps

• Lack of phishing-resistant MFA (FIDO2/Passkeys)
• Over-reliance on 'FileDownloaded' events while ignoring 'FileAccessed' events for data exfiltration monitoring
• Insufficient monitoring of new MFA device registrations

Key Behavioral Indicators

• User-Agent strings indicating scripting engines (e.g., python-requests/2.28.1, WindowsPowerShell/5.1) accessing SharePoint/OneDrive.
• ClientAppId spoofed as 'Microsoft Office' combined with a scripting User-Agent.
• High volume of FileAccessed events in a short time window exceeding human browsing capabilities.
• Subdomains registered with Tucows containing 'passkey', 'enrollment', or 'setupsso' themes.

False Positive Assessment

• Medium

Recommendations

Immediate Mitigation

• Verify against your organization's incident response runbook and team escalation paths before acting.
• Consider reviewing identity provider logs for recent anomalous MFA device registrations, particularly those following failed authentication attempts.
• Evaluate whether to implement conditional access policies that block or challenge authentications from known commercial VPN exit nodes and hosting providers.

Infrastructure Hardening

• Evaluate transitioning to phishing-resistant MFA, such as FIDO2-compliant security keys or passkeys, to mitigate AiTM attacks.
• Consider configuring environment-specific credential guarding, such as Google Workspace Password Alert or Microsoft Defender SmartScreen, to intercept credential submissions on low-reputation sites.

User Protection

• If supported by your IdP, consider monitoring for specific IdP SDK User-Agents on devices not previously associated with a user's profile.
• Evaluate implementing strict session timeout policies for critical SaaS applications to limit the window of opportunity for hijacked session cookies.

Security Awareness

• Consider updating security awareness training to specifically address vishing tactics, emphasizing that IT support will never ask for MFA codes over the phone.
• Evaluate establishing and communicating a clear, out-of-band verification process for employees to confirm the identity of IT personnel requesting security changes.

MITRE ATT&CK Mapping

• T1566.004 - Phishing: Spearphishing Voice
• T1111 - Two-Factor Authentication Interception
• T1078.004 - Valid Accounts: Cloud Accounts
• T1556 - Modify Authentication Process
• T1530 - Data from Cloud Storage Object
• T1059.001 - Command and Scripting Interpreter: PowerShell
• T1059.006 - Command and Scripting Interpreter: Python