A new data extortion group, dubbed Helix, has emerged, employing voice phishing (vishing) and multi-factor authentication (MFA) abuse to compromise SharePoint environments and exfiltrate data. The group's primary objective is to extort victim organizations by threatening to publish stolen information or sell it to other cybercriminals.
Helix initiates its attacks with vishing calls, often impersonating a target's manager, sometimes using caller ID spoofing to enhance legitimacy. The goal of these calls is to trick employees into participating in device-code phishing schemes, which grant the attackers initial access to their accounts. Once inside, Helix operators quickly register a new MFA authenticator app to maintain persistence within the compromised environment.
Following initial access and persistence, Helix systematically enumerates SharePoint content. Researchers at ReliaQuest observed a consistent technical fingerprint across incidents: automated enumeration and collection originating from the IP address 179.43.185[.]230, using the user-agent "python-requests/2.28.1". The attackers issue specific SharePoint searches, including `contentclass:STS_Site` and wildcard (`*`) queries, to inventory all accessible content before bulk-downloading files from the same IP address and user-agent.
ReliaQuest suggests a potential connection between Helix and the previously active ShinyHunters and BlackFile data extortion groups, though a definitive link has not been confirmed. The emergence of Helix shortly after BlackFile ceased operations in April, coupled with shared infrastructure, lends credence to this theory. One Helix attack reportedly used an exfiltration IP address within the same autonomous system (AS 51852) that hosted a confirmed BlackFile IP address.
Furthermore, Helix's social engineering tactics, including vishing, employee impersonation, targeting Microsoft 365, and SharePoint data theft, closely mirror the playbook of ShinyHunters. The use of the NICENIC registrar in Helix campaigns also aligns with past ShinyHunters activities. Several organizations, including Medtronic, Nissan, NAIC, Kodak, Infinite Campus, and Nottingham University, have recently confirmed data breaches previously claimed by ShinyHunters.
To mitigate the risk of Helix attacks, cybersecurity experts recommend disabling device code authentication where feasible. Other defensive measures include restricting SharePoint access to only managed devices and blocking communication with newly registered domains, which Helix frequently utilizes in its operations.
