BlackFile, tracked by Google Threat Intelligence Group as UNC6671 and linked to The Com, has remained active while expanding its extortion campaigns across financial, healthcare, technology, and other sectors. The group uses voice phishing, social engineering, and shared brands like Redact, Pink, Helix, and Falcon to pressure large organizations, including firms such as Blackstone, Bain Capital, Moody’s, CME, and Apollo. #BlackFile #UNC6671 #TheCom #Redact #Pink #Helix #Falcon #Blackstone #BainCapital #Moodys #CME #Apollo
Keypoints
- BlackFile continues targeting new victims across multiple industries.
- The group uses voice-phishing and social engineering to gain initial access.
- Its extortion operations now run under four shared brands: Redact, Pink, Helix, and Falcon.
- The group focuses on large organizations and often demands multi-million-dollar payments.
- Researchers have observed activity against firms such as Blackstone, Bain Capital, Moody’s, CME, and Apollo.
Read More: https://cyberscoop.com/blackfile-cyberattacks-financial-sector/