The BlackFile extortion group, identified by Google Threat Intelligence Group (GTIG) as UNC6671, has reportedly rebranded to Redact, despite announcing its retirement earlier in 2026. This rebrand, along with the emergence of other related extortion brands like Pink, Helix, and Falcon, is believed by GTIG to be a coordinated effort by the same threat actors to compartmentalize operations, obscure overall breach volumes, and mitigate negotiation fallout.
Redact operators published a blog post on June 27, announcing their new data lead site (DLS) and the rebrand from BlackFile. They claimed the original BlackFile brand had been compromised and hijacked by an exiled affiliate. This rogue affiliate was accused of operating an unauthorized, lookalike DLS, conducting unsanctioned extortion campaigns under BlackFile’s name using unlinked Tox identities, and orchestrating the supposed shutdown of the BlackFile brand in May 2026.
GTIG’s analysis, however, points to significant overlaps in phishing templates, victimology, and shared infrastructure, suggesting a unified operation behind these various brands. For instance, generic root domains such as passkeyhelpdesk[.]com and passkeydeploy[.]com were reused across multiple target organizations. The same phishing templates were observed across all identified domains, with some domains simultaneously targeting two distinct victims, one claimed by Falcon and the other by Helix.
The initial access and post-compromise tactics, techniques, and procedures (TTPs) employed by the group have largely remained consistent, regardless of the brand name. The cybercriminal group primarily uses voice phishing (vishing) to target enterprise employees, impersonating IT helpdesk staff to facilitate urgent security migrations. These calls often target personal devices and direct victims to spoofed login portals.
At these portals, Adversary-in-the-Middle (AiTM) infrastructure intercepts credentials and multi-factor authentication (MFA) tokens. Once session persistence is established, automated scripts are deployed to exfiltrate data from enterprise cloud environments, including Microsoft 365 and Okta.
New techniques observed by GTIG include the use of spoofed legitimate helpdesk phone numbers. The pretext for these calls is an urgent mandate to enable FIDO2 passkeys or update multi-factor authentication enrollment, directing employees to lookalike credential-harvesting subdomains. UNC6671 has also been seen using compromised email accounts to reset passwords for enterprise applications, subsequently deleting security notifications and alert emails to evade detection and maintain persistent access.
UNC6671's targeting strategy evolved between April and July 2026. From April to May, the group focused on large enterprises in manufacturing, real estate, healthcare, and insurance. In June, their focus shifted to technology, transportation, and hospitality firms. By July, they narrowed their scope to high-value financial and legal organizations, including private equity firms, law firms, and credit rating agencies.
Between January 7 and May 12, GTIG reviewed 18 BlackFile Bitcoin wallet addresses, which received a total of 141.65 BTC. This amount represented approximately $10.69 million USD at the time of the transactions.
GTIG provided several mitigation recommendations, including enforcing phishing-resistant authenticators, integrating single sign-on (SSO), enforcing session controls to reduce session length, and restricting authentication to trusted network sources. Given that vishing calls often target personal devices, GTIG also advised firms to ensure that authentication originates from a corporate-managed endpoint equipped with Mobile Device Management (MDM) and Endpoint Detection and Response (EDR).
