Google Threat Intelligence Group tracked UNC6671, also operating as BlackFile, using vishing, AiTM, and SSO compromise to break into Microsoft 365 and Okta environments and steal data for extortion. The group then used scripted exfiltration, targeted ransom notes, and a BlackFile data leak site to pressure victims across North America, Australia, and the UK. #UNC6671 #BlackFile #Microsoft365 #Okta #Tox #Session
Keypoints
- UNC6671 is an extortion-focused threat actor operating under the BlackFile brand.
- The group uses voice phishing and adversary-in-the-middle methods to steal credentials and bypass MFA.
- Primary targets include Microsoft 365 and Okta environments, especially SharePoint, OneDrive, Zendesk, Salesforce, and Entra data.
- UNC6671 uses Python, PowerShell, Microsoft Graph, and direct HTTP requests to automate large-scale data theft.
- The actor often registers attacker-controlled MFA devices to maintain persistence after initial access.
- Extortion messages evolved from unbranded emails to BlackFile-branded demands using Session, with aggressive deadlines and escalation tactics.
- The BlackFile data leak site appeared in February 2026, later went offline, and may indicate a rebrand rather than a shutdown.
MITRE Techniques
- [T1566.004] Phishing: Voice Phishing – Used callers to trick victims into sharing credentials and MFA approvals by phone (‘high-volume voice phishing (vishing)’).
- [T1133] External Remote Services – Gained access through SSO portals and identity infrastructure such as Microsoft 365 and Okta (‘targets organizations via … single sign-on (SSO) compromise’).
- [T1557.002] Adversary-in-the-Middle: Rogue Ingress Tool Transfer – Intercepted credentials and MFA in real time during the vishing flow (‘live adversary-in-the-middle (AiTM) attack’).
- [T1078] Valid Accounts – Used stolen username/password pairs and session cookies to authenticate as the victim (‘captures these in real-time and immediately submits them to the legitimate SSO provider’).
- [T1098.005] Additional Cloud Credentials – MFA Device Registration – Registered attacker-controlled MFA devices for persistence (‘register a new, attacker-controlled MFA device’).
- [T1213] Data from Information Repositories – Accessed SharePoint, OneDrive, Salesforce, Zendesk, and other SaaS repositories for theft (‘move laterally across the victim’s SaaS applications’).
- [T1087.004] Account Discovery: Cloud Account – Queried internal search and tenant data to identify valuable information (‘queried internal search functions for string literals such as “confidential” and “SSN”‘).
- [T1041] Exfiltration Over C2 Channel – Streamed file content to attacker infrastructure using scripts and APIs (‘stream” file content directly to attacker-controlled infrastructure’).
- [T1105] Ingress Tool Transfer – Used scripts and libraries to retrieve data from cloud services via direct requests (‘python-requests library and PowerShell to issue direct HTTP GET requests’).
- [T1119] Automated Collection – Automated high-volume harvesting of files and records (‘access and download over a million individual files’).
Indicators of Compromise
- [IP address ] SharePoint access and scripted exfiltration observed from non-standard infrastructure – 179.43.185.226, and other VPN/hosting IPs
- [User-Agent strings ] Automated file access using scripting tools – python-requests/2.28.1, WindowsPowerShell/5.1
- [Domains ] Credential-harvesting and enrollment-themed subdomains used in vishing campaigns – enrollms[.]com, passkeyms[.]com, and setupsso[.]com
- [Email addresses / sender patterns ] Extortion emails sent from consumer Gmail accounts with pseudo-random usernames – [pseudorandom_alphanumeric_string]@gmail.com, and other similar accounts
- [URLs / Site URLs ] Target SharePoint sites involved in file access and download activity – https://organization.sharepoint.com/sites/Legal_Archive/, https://company.sharepoint.com/sites/ProductionOps/
- [File names ] Example files accessed or downloaded during exfiltration – 2382_REDACTED_MSA_v3.docx, Weekly Production Report.pbix
- [Session / Tox IDs ] Victim contact identifiers used in extortion notes – unique Session ID, Tox ID
- [Correlation / App context IDs ] Telemetry values useful for log correlation – b94b01a2-2019-c000-2262-5ff1d0ff6cc8, d3590ed6-52b3-4102-aeff-aad2292ab01c
Read more: https://cloud.google.com/blog/topics/threat-intelligence/blackfile-vishing-extortion-operation/