UNC6671 Rebrands Extortion Operations After Receiving Over $10 Million in Bitcoin
Summary
GTIG reports that UNC6671 retired BlackFile and now operates under several extortion brands. Its findings describe evolving helpdesk vishing tactics and more than $10 million in Bitcoin payments tracked from January to May.
Key points
- GTIG links the BlackFile, Redact, Pink, Helix, and Falcon extortion brands to a common group, while noting that splintered affiliates or shared phishing infrastructure are also plausible.
- The group impersonates IT helpdesk staff and directs employees to spoofed login portals to steal credentials and MFA tokens.
- Recent tactics include spoofing legitimate helpdesk numbers and resetting passwords for non-SSO applications while deleting related alerts and notifications.
- GTIG says the group has focused recent attacks on financial services, private equity, and professional services.
- GTIG tracked over $10 million in Bitcoin ransom payments across 18 wallets between January and May.
- GTIG reports that final payments averaged $750,000 in over 53% of tracked cases during that period.
Article Details
- Event Type
- Extortion group rebrand and evolution of phishing-led operations
- Impact
- GTIG reports that UNC6671 has continued its operations under the Redact, Pink, Helix, and Falcon brands after retiring BlackFile. Its vishing and credential-harvesting attacks target organizations’ credentials and MFA tokens and can enable access to cloud environments. From January to May, the group received more than $10 million in Bitcoin across 18 wallet addresses; GTIG says final payments averaged $750,000 in over 53% of tracked cases.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | addssopasskey[.]com | Domain identified by GTIG as part of UNC6671's generic root domains used across victims in credential-harvesting activity. |
| DOMAIN | mysecurepasskey[.]com | Domain identified by GTIG as part of UNC6671's generic root domains used across victims in credential-harvesting activity. |
| DOMAIN | passkeydeploy[.]com | Domain identified by GTIG as part of UNC6671's generic root domains used across victims in credential-harvesting activity. |
| DOMAIN | passkeyhelpdesk[.]com | Domain identified by GTIG as part of UNC6671's generic root domains used across victims in credential-harvesting activity. |
| DOMAIN | passkeyuser[.]com | Domain identified by GTIG as part of UNC6671's generic root domains used across victims in credential-harvesting activity. |
| DOMAIN | portalpasskey[.]com | Domain identified by GTIG as part of UNC6671's generic root domains used across victims in credential-harvesting activity. |
MITRE ATT&CK
T1056.003 · Web Portal CaptureThe group uses spoofed login portals to harvest credentials and MFA tokens.T1557 · Adversary-in-the-MiddleThe article reports adversary-in-the-middle techniques used to intercept credentials and bypass MFA.T1566.004 · Spearphishing VoiceUNC6671 reportedly impersonates IT helpdesk employees in voice-phishing calls to lure victims to spoofed login portals.
Threat Actors
Vendors
MicrosoftMainly focusing on Microsoft 365 and Okta infrastructure, it was leveraging adversary-in-the-middle (AiTM) techniques to bypass defenses and multi-factor authentication (MFA) and gain access to cloud environments.OktaMainly focusing on Microsoft 365 and Okta infrastructure, it was leveraging adversary-in-the-middle (AiTM) techniques to bypass defenses and multi-factor authentication (MFA) and gain access to cloud environments.
Products
Microsoft 365 Apps for EnterpriseMainly focusing on Microsoft 365 and Okta infrastructure, it was leveraging adversary-in-the-middle (AiTM) techniques to bypass defenses and multi-factor authentication (MFA) and gain access to cloud environments.OktaMainly focusing on Microsoft 365 and Okta infrastructure, it was leveraging adversary-in-the-middle (AiTM) techniques to bypass defenses and multi-factor authentication (MFA) and gain access to cloud environments.
Countries
AustraliaIn May, GTIG warned it had targeted dozens of organizations across North America, Australia, and the UK in sophisticated vishing and single sign-on (SSO) compromise attacks.United KingdomIn May, GTIG warned it had targeted dozens of organizations across North America, Australia, and the UK in sophisticated vishing and single sign-on (SSO) compromise attacks.
Industries
Financial ServicesThe latest attacks have focused on the financial services, private equity, and professional services sectors.Private equityThe latest attacks have focused on the financial services, private equity, and professional services sectors.Professional ServicesThe latest attacks have focused on the financial services, private equity, and professional services sectors.