ReliaQuest Details Helix SharePoint Data-Extortion Tactics
Summary
ReliaQuest says Helix uses vishing, device-code phishing and MFA abuse to access SharePoint, add an authenticator for persistence and bulk-download files for extortion. It sees possible links to ShinyHunters and BlackFile and recommends disabling device-code login.
Key points
- Helix reportedly impersonates employees’ managers by phone to lure them into device-code phishing and gain account access.
- After access, operators register a new MFA authenticator, enumerate SharePoint content and bulk-download files for extortion.
- ReliaQuest says the same SharePoint enumeration and collection pattern appeared across incidents; it cites searches for contentclass:STS_Site and wildcard (*) queries.
- The researchers associate the activity with IP 179.43.185[.]230 and the python-requests/2.28.1 user agent.
- ReliaQuest sees possible links to ShinyHunters and BlackFile based on tactics and infrastructure, but says it found no definitive connection.
- Recommended defenses include disabling device-code authentication where possible, limiting SharePoint access to managed devices and blocking exchanges with newly registered domains.
Article Details
- Event Type
- Data-extortion attacks using vishing, device-code phishing, and MFA abuse to steal data from SharePoint environments.
- Impact
- Helix operators reportedly enumerate SharePoint content and bulk-download sensitive files. The stolen data is used to threaten publication unless a ransom is paid, or is sold to other cybercriminals.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 179[.]43[.]185[.]230 | IP address used for SharePoint enumeration and bulk file downloads in Helix attacks, according to ReliaQuest researchers. |
MITRE ATT&CK
Threat Actors
BlackFileReliaQuest believes Helix may have emerged from BlackFile based on tactics and infrastructure. Researchers noted a Helix exfiltration IP in the same autonomous system as an IP confirmed to be used by BlackFile; the article says BlackFile ceased operations in April.HelixA data-extortion group reported to use vishing, device-code phishing, and MFA abuse to access SharePoint environments and steal files.ShinyHuntersReliaQuest believes Helix may have emerged from ShinyHunters based on similarities in tactics and infrastructure, but researchers found no definitive connection.
Vendors
Products
Microsoft 365 Apps for EnterpriseConcerning the link to ShinyHunters, Helix demonstrates a very similar social engineering playbook, including vishing, employee impersonation, targeting Microsoft 365, and stealing SharePoint data.Microsoft SharePointHelix is a new data-extortion group that uses vishing, device code phishing, and MFA abuse to gain access to SharePoint environments and steal sensitive files.