The BlackFile extortion group, which targets its victims through vishing scams, has rebranded.
According to an analysis by Google Threat Intelligence Group (GTIG), despite BlackFile (UNC6671) having announced the retirement of its brand in 2026, it had now rebranded to Redact.
Researchers said the group’s public communications cited an affiliate breakaway as the rationale for the initial rebrand.
However, overlaps in phishing templates, victimology and shared infrastructure conduits suggests that associated actors have subsequently leveraged the Pink, Helix and Falcon extortion brands to monetize their operations.
Redact operators published a blog post about their new data lead site (DLS) and the rebrand from Black File on June 27.
The group claimed that the original BlackFile brand had been compromised and hijacked by an exiled affiliate.
A rogue affiliate was apparently responsible for operating an unauthorized, lookalike DLS and conducted unsanctioned extortion campaigns under BlackFile’s name using unlinked Tox identities. They were also accused of orchestrating the supposed shutdown of the BlackFile brand in May 2026.
Vishing Scams Impersonate IT Help Desks
Whatever name the group operates under now, the initial access and post-compromise tactics, techniques, and procedures (TTPs) have largely remained the same, according to GTIG.
GTIG said, “This most likely reflects a coordinated group of threat actors operating multiple public extortion brands possibly in an effort to compartmentalize operations, hide overall breach volumes and isolate any negotiation fallout.”
The cybercriminal group uses voice phishing to target enterprise employees, posing as IT helpdesk staff facilitating mandatory, urgent security migrations. Victims are often targeted via their personal devices.
The calls lure targets to spoofed login portals where Adversary-in-the-Middle (AiTM) infrastructure intercepts credentials and multi-factor authentication (MFA) tokens.
Once session persistence is established, the actors deploy automated scripts for data exfiltration from enterprise cloud environments, including Microsoft 365 and Okta.
GTIG was able to connect the BlackFile, Redact, Pink, Helix and Falcon extortion brands because rather than maintaining isolated infrastructure for each target, UNC6671 reuses generic root domains across multiple target organizations.
Root domains like passkeyhelpdesk[.]com and passkeydeploy[.]com were used by more than one of the groups.
Across all the domains identified by GTIG, the researchers noted that the same phishing templates were used.
Some domains were simultaneously used to target two entirely separate victims, one of which was claimed by Falcon, and the other by Helix.
“The widespread deployment of these matching templates to harvest credentials for multiple DLS brands suggests they rely on shared underlying infrastructure,” the researchers said.
New Techniques and Victim Evolutions
New techniques deployed by UNC6671 observed by GTIG include the use of a spoofed legitimate helpdesk phone number. The pretext of the calls is an urgent mandate to enable FIDO2 passkeys or update multi-factor authentication enrollment, the caller directs the employee to a lookalike credential-harvesting subdomain.
UNC6671 has also been observed using compromised email accounts to reset passwords for enterprise applications and then delete security notifications and alert emails to evade detection and maintain persistent access.
UNC6671's targeting evolved significantly between April and July 2026. From April to May, the group focused on large enterprises in the manufacturing, real estate, healthcare and insurance sectors.
In June, it shifted to technology, transportation and hospitality firms, before narrowing its focus in July to high-value financial and legal organizations, including private equity firms, law firms and credit rating agencies.
GTIG said between January 7 and May 12 it reviewed 18 BlackFile Bitcoin wallet addresses receiving a total of 141.65 BTC, representing approximately $10.69m USD at the time of the transactions.
GTIG’s analysis of the extortion campaigns also included various recommendations for mitigation, including enforcing phishing-resistant authenticators, integrating single sign-on (SSO), enforcing session controls to reduce session length and restricting authentication to trusted network sources.
Because the scam often involves vishing calls that target personal devices, GTIG said firms should ensure that authentication comes from a corporate-managed endpoint with MDM and EDR.