Report Links BlackFile Extortion Group to Vishing Attacks on Retail and Hospitality
Summary
RH-ISAC and Unit 42 report that BlackFile has used vishing since February 2026 to steal credentials and exfiltrate Salesforce and SharePoint data from retail and hospitality organizations, then demand ransoms. Recommended defenses include caller verification and staff
Key points
- RH-ISAC and Unit 42 describe BlackFile, also tracked as CL-CRI-1116, UNC6671, and Cordial Spider, as targeting retail and hospitality organizations since February 2026.
- According to RH-ISAC, callers using spoofed numbers impersonate IT support and direct employees to fake login pages to steal credentials and one-time passcodes.
- The reported attackers register their own devices using stolen credentials to bypass multifactor authentication, then seek executive-level access by scraping employee directories.
- The group reportedly uses Salesforce APIs and SharePoint download functions to find and exfiltrate files, including documents containing terms such as “confidential” and “SSN.”
- The article says stolen documents are published on a dark web leak site and victims receive ransom demands; employees have also faced reported swatting attempts.
- Unit 42 linked BlackFile to The Com with moderate confidence. RH-ISAC recommends stronger caller identity checks, call-handling policies, and social-engineering simulations.
Article Details
- Event Type
- Vishing-led data theft and extortion campaign
- Impact
- Since February 2026, the financially motivated group tracked as BlackFile has targeted retail and hospitality organizations by impersonating IT helpdesk staff to steal employee credentials. The attackers register devices to bypass multifactor authentication, access executive accounts, and exfiltrate confidential files from Salesforce and SharePoint. Stolen data is published on a leak site, and victims face seven-figure ransom demands; employees have also been targeted with swatting attempts.
MITRE ATT&CK
T1098.005 · Device RegistrationAfter obtaining credentials, attackers reportedly register their own devices to bypass multifactor authentication.T1530 · Data from Cloud StorageAttackers reportedly use Salesforce and SharePoint access to search for and download confidential files from victims’ cloud-stored data.T1566.004 · Spearphishing VoiceThe group reportedly uses voice-based phishing calls, impersonating IT support and directing employees to fake corporate login pages to steal credentials and one-time passcodes.
People
Threat Actors
BlackFileA financially motivated group linked to vishing-led credential theft, data exfiltration, and extortion attacks against retail and hospitality organizations. The article says it is also tracked as CL-CRI-1116, UNC6671, and Cordial Spider.Cordial SpiderA name used for the group also tracked as BlackFile, CL-CRI-1116, and UNC6671, which is linked to vishing-led credential theft, data exfiltration, and extortion.The ComUnit 42 researchers linked BlackFile to The Com with moderate confidence. The article describes The Com as a loose-knit network of English-speaking cybercriminals associated with extortion, violence, and the production of child sexual exploitation material.UNC6671A tracking name for the group also identified as BlackFile, CL-CRI-1116, and Cordial Spider, which is linked to vishing-led credential theft, data exfiltration, and extortion.
Products
Gmailvictims are contacted with ransom demands via compromised employee email accounts or randomly generated Gmail addresses.Microsoft SharePointUsing stolen credentials to register devices and abuse Salesforce and SharePoint APIs, the attackers exfiltrate confidential data to a dark web leak site and sometimes employ swatting; Unit 42 and RH-ISAC link the groupSalesforceUsing stolen credentials to register devices and abuse Salesforce and SharePoint APIs, the attackers exfiltrate confidential data to a dark web leak site and sometimes employ swatting; Unit 42 and RH-ISAC link the group