[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDFcqEhdzJWLbZXDpXp0156R-zG5k8WUd-Q-jgyY7F6M":3},{"article":4,"iocs":55,"watch_terms":70,"solutions":71,"lesson":163},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"60afd0fe-914a-44b0-84d3-7121c4359399","Vishing Extortion Group UNC6671 Rebrands After Making Millions","vishing-extortion-group-unc6671-rebrands-after-making-millions-7c6beb","Initially calling itself BlackFile, the group has expanded operations to the Redact, Pink, Helix, and Falcon brands. The post Vishing Extortion Group UNC6671 Rebrands After Making Millions appeared first on SecurityWeek.","The vishing extortion group UNC6671, previously known as BlackFile, has rebranded and expanded its operations under new names including Redact, Pink, Helix, and Falcon. The group targets organizations by posing as IT helpdesk staff to trick employees into revealing credentials and MFA tokens through spoofed login portals. UNC6671 has reportedly extorted over $10 million in Bitcoin, with initial ransom demands ranging from $1 million to $3 million.","Vishing extortion group UNC6671, formerly BlackFile, rebrands under new names and continues operations.","https:\u002F\u002Fwww.securityweek.com\u002Fvishing-extortion-group-unc6671-rebrands-after-making-millions\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002Fvishing.jpeg","2026-08-07T11:06:01+00:00","2026-08-07T12:00:14.471594+00:00",8,[17,20,22,25,27,30],{"name":18,"type":19},"UNC6671","threat_actor",{"name":21,"type":19},"BlackFile",{"name":23,"type":24},"Microsoft 365","product",{"name":26,"type":24},"Okta",{"name":28,"type":29},"Adversary-in-the-Middle (AiTM)","technology",{"name":31,"type":29},"Multi-Factor Authentication (MFA)","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[56,60,62,64,66,68],{"type":57,"value":58,"context":59},"domain","passkeyhelpdesk[.]com","Generic root domain used by UNC6671 for credential harvesting.",{"type":57,"value":61,"context":59},"portalpasskey[.]com",{"type":57,"value":63,"context":59},"addssopasskey[.]com",{"type":57,"value":65,"context":59},"passkeydeploy[.]com",{"type":57,"value":67,"context":59},"mysecurepasskey[.]com",{"type":57,"value":69,"context":59},"passkeyuser[.]com",[23,26],{"controls":72,"vendors":156},[73,101,130],{"slug":74,"name":75,"problem":76,"products":77},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[78,86,94],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":95,"vendor_name":26,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":102,"name":103,"problem":104,"products":105},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[106,114,122],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"slug":131,"name":132,"problem":133,"products":134},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[135,141,149],{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":136,"product_name":137,"url":139,"description":140},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":150,"vendor_name":151,"vendor_logo":152,"product_slug":131,"product_name":153,"url":154,"description":155},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[157],{"slug":158,"name":159,"logo_path":160,"roles":161},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[162],"reported_by",{"slug":164,"title":165,"body":166,"framework_refs":167,"framework_notes":178},"vishing-group-unc6671-exploits-employee-trust-to-steal-credentials-and-mfa-tokens","Vishing Group UNC6671 Exploits Employee Trust to Steal Credentials and MFA Tokens","UNC6671 succeeds by exploiting the human element — employees who trust inbound calls from apparent IT helpdesk staff and willingly surrender credentials and MFA tokens to spoofed portals. The root failure is insufficient security awareness training combined with weak access control processes that allow verbal or unverified requests to bypass authentication safeguards. This matters because even technically robust environments can be completely compromised when social engineering circumvents technical controls. The group's $10M+ in extorted Bitcoin demonstrates that vishing is a high-return, low-cost attack vector that scales easily under rebranded identities.",[168,169,170,171,172,173,174,175,176,177],"CIS Control 14 – Security Awareness and Skills Training","CIS Control 6 – Access Control Management","NIST SP 800-50 – Security Awareness and Training","NIST AC-2 – Account Management","NIST IA-2 – Identification and Authentication (Phishing-Resistant MFA)","NIST SP 800-63B – Digital Identity Guidelines (Authenticator Assurance Levels)","MITRE ATT&CK T1598 – Phishing for Information","MITRE ATT&CK T1566.004 – Vishing","ISO\u002FIEC 27001 A.6.3 – Information Security Awareness, Education and Training","GDPR Article 32 – Security of Processing (applicable if EU data is involved)",{}]