Google Details UNC6671’s BlackFile Vishing and SaaS Extortion Operations
Summary
Google GTIG details UNC6671’s vishing and AiTM attacks against Microsoft 365 and Okta, scripted SaaS data theft, and extortion tactics. It also shares forensic indicators and defensive guidance; the BlackFile leak site’s shutdown may signal a rebrand.
Key points
- GTIG says UNC6671, also known as BlackFile, targeted dozens of organizations across North America, Australia, and the UK.
- Callers posing as IT staff direct employees to credential-harvesting pages, then relay credentials and MFA approvals to legitimate SSO portals.
- After access, the actor may register attacker-controlled MFA devices and use compromised accounts to reach SharePoint, OneDrive, Zendesk, and Salesforce.
- GTIG observed Python, PowerShell, and Microsoft Graph used for automated data theft; direct file requests can appear as FileAccessed events rather than FileDownloaded.
- In one case, the actor accessed and downloaded more than a million files from a victim’s SharePoint and OneDrive environments.
- GTIG recommends phishing-resistant MFA and monitoring for anomalous MFA setup, scripting user agents, unusual file-access volumes, and suspicious identity-provider activity.
- The BlackFile leak site went offline in late April 2026 and briefly returned in May with a shutdown message; GTIG says this may indicate a transition rather than a permanent end to the activity.
Article Details
- Attack Vectors
- Callers impersonated internal IT or help desk staff and used passkey or MFA-update pretexts to direct employees to credential-harvesting subdomains.
- UNC6671 used real-time adversary-in-the-middle phishing to capture credentials and MFA approvals, then registered attacker-controlled MFA devices for persistence.
- The actor used compromised SSO accounts and session cookies to access victim SaaS environments and search for high-value data.
- Python and PowerShell scripts, Microsoft Graph, and direct HTTP requests were used to automate data access and exfiltration from SharePoint and OneDrive.
- UNC6671 used targeted extortion emails and escalated pressure through spam, threatening voicemails, and, in severe cases, swatting.
- Defensive Notes
- Use phishing-resistant MFA, such as FIDO2 security keys or passkeys, instead of SMS- or push-based MFA.
- Monitor identity-provider logs for MFA setup events preceded by failed or abandoned MFA challenges.
- Investigate anomalous authentication from commercial VPN or hosting infrastructure and monitor for scripting User-Agent strings.
- Review SaaS audit logs for high-volume FileAccessed and FileDownloaded activity; assess suspicious FileAccessed events as seriously as downloads.
- Monitor for direct file streaming and unusually high volumes of file access in short periods, and use credential-guarding protections to detect submissions to unauthorized domains.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | enrollms[.]com | Domain used for organization-specific credential-harvesting subdomains in vishing campaigns. |
| DOMAIN | passkeyms[.]com | Domain used for organization-specific credential-harvesting subdomains in vishing campaigns. |
| DOMAIN | setupsso[.]com | Domain used for organization-specific credential-harvesting subdomains in vishing campaigns. |
| IPV4 | 179[.]43[.]185[.]226 | Source IP observed in UNC6671 SharePoint access and scripted data-exfiltration events; the article describes the activity as originating from non-standard infrastructure. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe actor streamed file content to attacker-controlled infrastructure using captured session cookies.T1059.001 · PowerShellPowerShell was used to issue direct HTTP requests and automate data access.T1059.006 · PythonPython scripts, including use of python-requests, automated SharePoint and OneDrive data access.T1078 · Valid AccountsThe actor used stolen credentials to authenticate as victims to legitimate SSO providers.T1098.005 · Device RegistrationAfter gaining access, the actor registered attacker-controlled MFA devices on compromised accounts for persistence.T1119 · Automated CollectionScripts automated high-volume harvesting, including access to more than a million individual files in one reported case.T1133 · External Remote ServicesUNC6671 gained access through victim SSO portals and identity infrastructure, including Microsoft 365 and Okta.T1213 · Data from Information RepositoriesThe actor accessed SharePoint, OneDrive, Salesforce, Zendesk, and other victim SaaS repositories to locate and steal data.T1550.004 · Web Session CookieThe actor reused session cookies captured during the vishing phase to access document resources.T1557 · Adversary-in-the-MiddleThe actor used real-time adversary-in-the-middle phishing to capture credentials and MFA responses.T1566.004 · Spearphishing VoiceCallers used voice phishing to trick victims into sharing credentials and approving MFA challenges.T1621 · Multi-Factor Authentication Request GenerationThe actor triggered MFA challenges and relied on victims to provide codes or approve prompts.
Threat Actors
BlackFileThe brand under which the article says UNC6671 operates; the group used the brand in extortion demands and on its data leak site.UNC6671Google Threat Intelligence Group tracked UNC6671 conducting vishing, SSO compromise, SaaS data theft, and extortion. The article says the group operates under the BlackFile brand.
Vendors
MicrosoftGoogle Threat Intelligence Group tracked UNC6671, also operating as BlackFile, using vishing, AiTM, and SSO compromise to break into Microsoft 365 and Okta environments and steal data for extortion.OktaGoogle Threat Intelligence Group tracked UNC6671, also operating as BlackFile, using vishing, AiTM, and SSO compromise to break into Microsoft 365 and Okta environments and steal data for extortion.SalesforcePrimary targets include Microsoft 365 and Okta environments, especially SharePoint, OneDrive, Zendesk, Salesforce, and Entra data.ZendeskPrimary targets include Microsoft 365 and Okta environments, especially SharePoint, OneDrive, Zendesk, Salesforce, and Entra data.
Products
EntraPrimary targets include Microsoft 365 and Okta environments, especially SharePoint, OneDrive, Zendesk, Salesforce, and Entra data.Microsoft 365 Apps for EnterpriseGoogle Threat Intelligence Group tracked UNC6671, also operating as BlackFile, using vishing, AiTM, and SSO compromise to break into Microsoft 365 and Okta environments and steal data for extortion.Microsoft GraphUNC6671 uses Python, PowerShell, Microsoft Graph, and direct HTTP requests to automate large-scale data theft.Microsoft OneDrivePrimary targets include Microsoft 365 and Okta environments, especially SharePoint, OneDrive, Zendesk, Salesforce, and Entra data.Microsoft SharePointPrimary targets include Microsoft 365 and Okta environments, especially SharePoint, OneDrive, Zendesk, Salesforce, and Entra data.Microsoft Teamsor ignored, since at least March 2026, UNC6671 has leveraged hijacked internal corporate email and Microsoft Teams accounts.OktaGoogle Threat Intelligence Group tracked UNC6671, also operating as BlackFile, using vishing, AiTM, and SSO compromise to break into Microsoft 365 and Okta environments and steal data for extortion.SalesforcePrimary targets include Microsoft 365 and Okta environments, especially SharePoint, OneDrive, Zendesk, Salesforce, and Entra data.ZendeskPrimary targets include Microsoft 365 and Okta environments, especially SharePoint, OneDrive, Zendesk, Salesforce, and Entra data.
Tools
PowerShellUNC6671 uses Python, PowerShell, Microsoft Graph, and direct HTTP requests to automate large-scale data theft.PythonUNC6671 uses Python, PowerShell, Microsoft Graph, and direct HTTP requests to automate large-scale data theft.python-requests[T1105] Ingress Tool Transfer – Used scripts and libraries to retrieve data from cloud services via direct requests (‘python-requests library and PowerShell to issue direct HTTP GET requests’).Session#UNC6671Tox#UNC6671
Countries
AustraliaThe group then used scripted exfiltration, targeted ransom notes, and a BlackFile data leak site to pressure victims across North America, Australia, and the UK.United KingdomThe group then used scripted exfiltration, targeted ransom notes, and a BlackFile data leak site to pressure victims across North America, Australia, and the UK.