Vishing Extortion Group UNC6671 Rebrands After Making Millions
Vishing extortion group UNC6671, formerly BlackFile, rebrands under new names and continues operations.
The vishing extortion group UNC6671, previously known as BlackFile, has rebranded and expanded its operations under new names including Redact, Pink, Helix, and Falcon. The group targets organizations by posing as IT helpdesk staff to trick employees into revealing credentials and MFA tokens through spoofed login portals. UNC6671 has reportedly extorted over $10 million in Bitcoin, with initial ransom demands ranging from $1 million to $3 million.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft 365?
Get an email when a new story names Microsoft 365, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonUNC6671 succeeds by exploiting the human element — employees who trust inbound calls from apparent IT helpdesk staff and willingly surrender credentials and MFA tokens to spoofed portals. The root failure is insufficient security awareness training combined with weak access control processes that allow verbal or unverified requests to bypass authentication safeguards. This matters because even technically robust environments can be completely compromised when social engineering circumvents technical controls. The group's $10M+ in extorted Bitcoin demonstrates that vishing is a high-return, low-cost attack vector that scales easily under rebranded identities.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — passkeyhelpdesk[.]com
- domain — portalpasskey[.]com
- domain — addssopasskey[.]com
- domain — passkeydeploy[.]com
- domain — mysecurepasskey[.]com
- domain — passkeyuser[.]com