BlackFile Uses Voice Phishing to Extort Retail and Hospitality Organizations
Summary
Unit 42 and RH-ISAC say BlackFile has targeted retail and hospitality organizations since February through IT-support impersonation, credential theft and SaaS data access, seeking seven-figure ransoms. The campaign remains active; the victim count is undisclosed.
Key points
- Unit 42 says BlackFile has targeted retail and hospitality organizations since February and that the campaign remains active.
- The group reportedly impersonates IT support through voice phishing and phishing pages mimicking corporate single sign-on to steal credentials.
- RH-ISAC says attackers scrape employee directories and use social engineering to compromise senior accounts and gain persistent access.
- Reportedly accessed data and services include Microsoft Graph API permissions, Salesforce, SharePoint, internal repositories and employee or business records.
- Researchers say the group uses data-leak sites to pressure victims with ransom demands typically in the seven-figure range; the number of affected organizations is undisclosed.
- RH-ISAC advises verifying callers’ identities with multifactor checks and escalating IT support actions that cannot be completed safely in a single call.
Article Details
- Event Type
- Active voice-phishing, social-engineering, data-theft, and extortion campaign targeting retail and hospitality organizations.
- Impact
- Attackers impersonate IT support to steal credentials, compromise executive accounts, and maintain access to corporate environments. They exfiltrate data from SaaS platforms and APIs and threaten to publish it, reportedly seeking seven-figure ransoms. RH-ISAC also reported that some attackers swatted company personnel, including executives.
MITRE ATT&CK
T1078 · Valid AccountsThe article says attackers compromise executive and other privileged accounts and use them for persistent access.T1566.004 · Spearphishing VoiceThe group uses voice-phishing to lure victims and steal credentials.T1656 · ImpersonationAttackers impersonate IT support to gain credentials and access.
People
Threat Actors
BlackFileThe article attributes ongoing voice-phishing, social engineering, credential theft, data theft, and extortion activity to BlackFile.Cordial SpiderThe article identifies Cordial Spider as another tracking name for BlackFile. It also says CrowdStrike has tracked an overlapping data-theft and extortion campaign as Cordial Spider since at least October 2025.UNC6671The article identifies UNC6671 as another tracking name for BlackFile, which it reports is conducting voice-phishing, data-theft, and extortion activity.
Vendors
CrowdStrikeUnit 42 also noted that BlackFile’s activities overlap with an ongoing data theft and extortion campaign CrowdStrike has been tracking as Cordial Spider since at least October 2025.MicrosoftThey exfiltrate data from SaaS platforms and APIs—including Microsoft Graph, Salesforce and SharePoint—and publish dataâleak sites to extort victims with sevenâfigure demands.Palo Alto Networksin a campaign that remains active and ongoing, Matt Brady, senior principal researcher at Palo Alto Networks’ Unit 42, told CyberScoop.SalesforceThey exfiltrate data from SaaS platforms and APIs—including Microsoft Graph, Salesforce and SharePoint—and publish dataâleak sites to extort victims with sevenâfigure demands.
Products
Microsoft GraphThey exfiltrate data from SaaS platforms and APIs—including Microsoft Graph, Salesforce and SharePoint—and publish dataâleak sites to extort victims with sevenâfigure demands.Microsoft SharePointThey exfiltrate data from SaaS platforms and APIs—including Microsoft Graph, Salesforce and SharePoint—and publish dataâleak sites to extort victims with sevenâfigure demands.SalesforceThey exfiltrate data from SaaS platforms and APIs—including Microsoft Graph, Salesforce and SharePoint—and publish dataâleak sites to extort victims with sevenâfigure demands.
Industries
HealthcareThe group, linked to The Com and tracked as CL-CRI-1116/UNC6671/Cordial Spider, targets retail, hospitality, healthcare, technology, transportation, logistics and wholesale.HospitalityThe group, linked to The Com and tracked as CL-CRI-1116/UNC6671/Cordial Spider, targets retail, hospitality, healthcare, technology, transportation, logistics and wholesale.logisticsThe group, linked to The Com and tracked as CL-CRI-1116/UNC6671/Cordial Spider, targets retail, hospitality, healthcare, technology, transportation, logistics and wholesale.RetailThe group, linked to The Com and tracked as CL-CRI-1116/UNC6671/Cordial Spider, targets retail, hospitality, healthcare, technology, transportation, logistics and wholesale.TechnologyThe group, linked to The Com and tracked as CL-CRI-1116/UNC6671/Cordial Spider, targets retail, hospitality, healthcare, technology, transportation, logistics and wholesale.TransportationThe group, linked to The Com and tracked as CL-CRI-1116/UNC6671/Cordial Spider, targets retail, hospitality, healthcare, technology, transportation, logistics and wholesale.WholesaleThe group, linked to The Com and tracked as CL-CRI-1116/UNC6671/Cordial Spider, targets retail, hospitality, healthcare, technology, transportation, logistics and wholesale.