BlackFile Expands Extortion Campaigns Across Financial and Other Sectors
Summary
Google and Mandiant say BlackFile (UNC6671) remains active, using voice phishing and social engineering across four extortion brands. Mandiant has responded to more than two dozen compromised organizations; infrastructure targeting named firms does not confirm they were
Key points
- Google Threat Intelligence Group tracks BlackFile as UNC6671 and associates it with The Com; researchers say it has been active since the start of the year.
- The group impersonates IT support in voice-phishing and social-engineering attacks to gain initial access.
- Its extortion operations are spread across four brands—Redact, Pink, Helix and Falcon—with shared infrastructure.
- Google says some demands start around $3 million and have been negotiated below $1 million; it also reported new Redact demands in the prior week.
- Flashpoint observed malicious infrastructure targeting Blackstone, Bain Capital, Moody’s, CME and Apollo, but the article says it is unclear whether those firms were compromised.
- Mandiant responders have assisted more than two dozen organizations successfully compromised by the group since January.
- Google says some recent victims faced threatening messages and swatting; researchers estimate the group targets an average of 1.5 new victims daily.
Article Details
- Event Type
- Ongoing multi-sector cybercrime and extortion campaign using voice phishing, social engineering, and IT-support impersonation.
- Impact
- Mandiant reportedly responded to more than two dozen organizations successfully compromised by BlackFile since January. Researchers said the group averages 1.5 new victims per day and often makes extortion demands starting around $3 million, which have typically been negotiated down to less than $1 million. Researchers observed malicious infrastructure targeting Blackstone, Bain Capital, Moody’s, CME, and Apollo, but it is unclear whether those firms were compromised.
MITRE ATT&CK
People
Threat Actors
BlackFileThe article describes BlackFile as an active cybercrime and extortion group using voice phishing, social engineering, and IT-support impersonation to target organizations across multiple sectors.The ComBlackFile is linked more broadly to The Com. Google said swatting incidents affecting some recent victims are a tactic adopted by several subsets of The Com.UNC6671Google Threat Intelligence Group tracks BlackFile as UNC6671; the article describes the tracked group as conducting ongoing extortion and voice-phishing activity.
Vendors
GoogleBlackFile, tracked by Google Threat Intelligence Group as UNC6671 and linked to The Com, has remained active while expanding its extortion campaigns across financial, healthcare, technology, and other sectors.MandiantMandiant incident responders encounter BlackFile often, having been engaged by more than two dozen organizations successfully compromised by the threat group since January.
Industries
HealthcareBlackFile, tracked by Google Threat Intelligence Group as UNC6671 and linked to The Com, has remained active while expanding its extortion campaigns across financial, healthcare, technology, and other sectors.HospitalityBlackFile and its various affiliates have impacted organizations in multiple industries, including healthcare, technology, transportation, logistics, wholesale, retail and hospitality.logisticsBlackFile and its various affiliates have impacted organizations in multiple industries, including healthcare, technology, transportation, logistics, wholesale, retail and hospitality.RetailBlackFile and its various affiliates have impacted organizations in multiple industries, including healthcare, technology, transportation, logistics, wholesale, retail and hospitality.TechnologyBlackFile, tracked by Google Threat Intelligence Group as UNC6671 and linked to The Com, has remained active while expanding its extortion campaigns across financial, healthcare, technology, and other sectors.TransportationBlackFile and its various affiliates have impacted organizations in multiple industries, including healthcare, technology, transportation, logistics, wholesale, retail and hospitality.WholesaleBlackFile and its various affiliates have impacted organizations in multiple industries, including healthcare, technology, transportation, logistics, wholesale, retail and hospitality.