ReliaQuest Details Helix’s Identity-Driven Data-Extortion Campaign
Summary
ReliaQuest describes Helix using vishing and device-code phishing to access accounts, register MFA, and automate SharePoint collection across investigated incidents. Infrastructure and tradecraft suggest, but do not confirm, links to BlackFile and ShinyHunters.
Key points
- ReliaQuest identified Helix as a previously unreported group and reconstructed its playbook from investigations of activity against multiple targets.
- In a confirmed vishing case, a caller impersonated the target’s manager and guided them through a device-code flow to capture a session token without obtaining their password.
- Investigated cases showed sign-ins from unmanaged devices, new MFA registrations within minutes of access, and residential proxies; dwell time ranged from under an hour to more than a week.
- Helix automated SharePoint enumeration and bulk downloads using searches such as contentclass:STS_Site; collection activity was associated with 179.43.185[.]230 and python-requests/2.28.1.
- Shared tradecraft, registrar use, and hosting proximity suggest possible links to BlackFile and ShinyHunters, but ReliaQuest says the attribution is not confirmed.
- ReliaQuest recommends disabling or restricting device-code authentication, limiting sensitive SaaS access to managed endpoints, and blocking newly registered domains.
- Session revocation, account disablement, and password resets generally contained activity; in one case, the operator later tried to re-register MFA and reset the password.
Article Details
- Attack Vectors
- Vishing calls impersonated targets’ managers and guided users through a device-code authentication flow to capture session tokens.
- Target-specific subdomains under oskeysync[.]com were used for credential harvesting or device-code phishing.
- Operators registered a new MFA Authenticator app on compromised accounts, typically within minutes of initial access.
- Access used authenticated cloud sessions from unmanaged endpoints and residential proxies, sometimes geo-matched to the target.
- Automated activity enumerated SharePoint sites and bulk-downloaded content; one case also involved reading email and exfiltrating from a cloud storage platform.
- In observed cleanup, the operator deleted a phishing-awareness notification email from the target’s inbox.
- Defensive Notes
- Disable device-code authentication where possible; otherwise restrict it to a narrow set of managed devices and monitor anomalous requests.
- Require compliant or domain-joined managed endpoints for SharePoint, Exchange, and other sensitive SaaS applications.
- Block newly registered domains at proxy or DNS controls.
- Correlate unfamiliar sign-ins, new MFA registrations, SharePoint site enumeration, and bulk downloads; investigate activity using residential proxies or hosted IPs.
- For containment, terminate active sessions, disable the account, and reset its password across cloud and on-premises environments without delay.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | oskeysync[.]com | Phishing domain used by Helix with target-specific subdomains for credential harvesting or device-code phishing. |
| IPV4 | 179[.]43[.]185[.]226 | IP identified in the article as a confirmed BlackFile host; its hosting proximity to Helix’s exfiltration IP is cited as infrastructure overlap. |
| IPV4 | 179[.]43[.]185[.]230 | Helix-associated host used for automated SharePoint enumeration and bulk exfiltration. |
MITRE ATT&CK
T1020 · Automated ExfiltrationThe campaign used automated collection and bulk downloads for exfiltration from SharePoint.T1070.008 · Clear Mailbox DataIn incidents where cleanup was observed, the operator deleted a phishing-awareness notification email from the target’s inbox.T1078.004 · Cloud AccountsThe operator accessed cloud services through legitimate authenticated sessions and compromised accounts.T1098.005 · Device RegistrationPersistence was established by registering a new MFA Authenticator app on a compromised target account.T1114.002 · Remote Email CollectionIn one incident, the operator quietly read email from the target mailbox using rotating residential IP addresses.T1119 · Automated CollectionAutomated tools enumerated SharePoint content and mass-downloaded libraries.T1213.002 · SharepointThe operator searched SharePoint sites to inventory reachable content and then downloaded it in bulk.T1550.001 · Application Access TokenThe operator captured a session token through the device-code flow; in one incident, subsequent SharePoint access suggested the token was replayed directly.T1566.004 · Spearphishing VoiceA caller impersonated a target’s manager and used vishing to guide the target through the device-code flow.T1583.001 · DomainsThe campaign used the registered oskeysync[.]com domain and target-specific subdomains for phishing infrastructure.T1598 · Phishing for InformationDevice-code phishing and credential-harvesting subdomains were used to obtain access to target accounts.T1656 · ImpersonationThe caller impersonated the target user’s manager, using the manager’s identity and real contact details as a pretext.
Threat Actors
BlackFileA data extortion operation whose infrastructure and tradecraft overlap with Helix; ReliaQuest described a direct successor relationship as unconfirmed. The article identifies UNC6671 as another name for BlackFile.HelixReliaQuest identified Helix as a data extortion group and attributed the described vishing, device-code phishing, MFA abuse, and SharePoint exfiltration activity to it.PinkDescribed as a successor operation that emerged after BlackFile shut down and ran the same playbook; ReliaQuest assessed that it was not fully independent and was tied to the original ecosystem.RedactDescribed as a successor operation that emerged after BlackFile shut down and ran the same playbook; the article also reports that it publicly distanced itself from a former BlackFile member.Scattered SpiderThe article describes this as a name for the network also known as The Com, a loose community of threat actors associated with social engineering and data extortion.ShinyHuntersA data extortion group documented in the article as using vishing and target-branded credential-harvesting domains. Its relationship to BlackFile is described as contested, and a direct link to Helix is unconfirmed. The article identifies UNC6661 as another name for ShinyHunters.The ComThe article describes this as another name for the network known as Scattered Spider, a loose community of threat actors associated with social engineering and data extortion.UNC6661The article identifies UNC6661 as another name for ShinyHunters, whose reported tradecraft overlaps with Helix; a direct link to Helix is unconfirmed.UNC6671The article identifies UNC6671 as another name for BlackFile, whose infrastructure and tradecraft overlap with Helix; a direct link to Helix is unconfirmed.
Vendors
Products
ADIn hybrid environments, ensure the disable is applied to both Entra ID and on-premises AD simultaneously to avoid the sync gap documented in this report.Entra IDIn hybrid environments, ensure the disable is applied to both Entra ID and on-premises AD simultaneously to avoid the sync gap documented in this report.Google Chrome[T1656 ] Content Injection – The operator inserted a device code into a legitimate authentication flow to capture a session token (‘walked them through entering a device code into Chrome’).GreyMatter Agentic AIGreyMatter Agentic AI correlates isolated, low-fidelity events into a single intrusion narrative at machine speed.Microsoft SharePointReliaQuest identified Helix, a newly observed data extortion group that uses vishing, device code phishing, MFA abuse, and automated SharePoint exfiltration against multiple targets.