UNC6671 vishing extortion group shifts branding from BlackFile to new brands

Intelligence Summary

The UNC6671 vishing extortion group has rebranded its operations after generating substantial illicit revenue. It previously used the name BlackFile but has expanded under multiple new brand identities. Reported brands include Redact, Pink, Helix, and Falcon. The group’s phone-based intimidation and extortion model means victims are likely targeted through social engineering rather than software exploitation. Organizations should reinforce caller verification procedures and educate staff to recognize vishing tactics.

Recommended Action

Review affected assets, schedule urgent remediation, and monitor related indicators.

Topics