[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0pNPziX6G8jWiF5hMizYcCwzhM-BnYV0uEaSdKar104":3,"$fiChGSzRzxki22oFHUK1a9SvHGtYrOsrC_cZy0pyI7zU":62},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":59,"created_at":60,"updated_at":61,"published_at":43},"unc6671-rebrands-as-redact-pink-helix-and-falcon-after-millions-in-vishing-extor","UNC6671 Rebrands as Redact, Pink, Helix, and Falcon After Millions in Vishing Extortion","The group previously known as BlackFile has split its operations across four new DLS brands after generating millions in revenue through IT helpdesk voice phishing.","UNC6671, a data extortion group that rebranded from BlackFile in May 2026, has expanded into four new leak site brands — Redact, Pink, Helix, and Falcon — after raking in millions in extortion via vishing campaigns targeting enterprise employees.",[10,11,12,13,14],"UNC6671","vishing","extortion","BlackFile","DLS","# UNC6671 Rebrands as Redact, Pink, Helix, and Falcon After Millions in Vishing Extortion\n\n*The group previously known as BlackFile has split its operations across four new DLS brands after generating millions in revenue through IT helpdesk voice phishing.*\n\n**Tags:** `UNC6671` `vishing` `extortion` `BlackFile` `DLS`\n\n> UNC6671, a data extortion group that rebranded from BlackFile in May 2026, has expanded into four new leak site brands — Redact, Pink, Helix, and Falcon — after raking in millions in extortion via vishing campaigns targeting enterprise employees.\n\n---\n\n## UNC6671 Rebrands After Millions in Extortion\n\nUNC6671, a data extortion group previously operating under the BlackFile brand, has rebranded across four new fronts: Redact, Pink, Helix, and Falcon. The group targets enterprise employees via voice phishing, posing as IT helpdesk staff to push mandatory security migrations. Initial access relies on an AiTM Credential Harvesting Panel hosted on generic root domains that masquerade as passkey-related infrastructure, with victim-specific subdomains appended for targeted campaigns.\n\nVictims span Financial Services, Healthcare, Legal, Private Equity, Retail, Technology, and Transportation. The group has generated millions in extortion revenue, prompting the multi-brand expansion after the BlackFile retirement announced in May 2026.\n\n## How the Vishing Attack Works\n\nUNC6671 initiates the intrusion by calling target employees, posing as IT helpdesk staff to push a \"mandatory, urgent security migration.\" The call directs the victim to a URL that loads an AiTM Credential Harvesting Panel hosted on a generic root domain—typically passkeyhelpdesk[.]com—masquerading as passkey-related infrastructure. For targeted campaigns, the actor appends a victim-specific subdomain to the root, so each employee gets a unique URL that ties the session to the specific target.\n\nThe panel harvests credentials from Microsoft 365 and Okta, enabling session hijacking and MFA bypass once the victim authenticates. Post-compromise TTPs remain consistent across all four brands—Redact, Pink, Helix, and Falcon—with shared infrastructure conduits linking the operations. The same root domain and panel template appear across multiple target organizations, creating a traceable chain between the extortion fronts.\n\n## The Four New Extortion Brands\n\nRedact was the first of the four brands to appear, with the group publishing a blog post on a newly established Data Leak Site on June 27, 2026. The post explicitly denied that pressure from rival groups influenced the rebranding decision, a claim that aligns with the timing of the BlackFile retirement announced in May 2026.\n\nPink, Helix, and Falcon round out the set. All four brands share the same TTPs, victimology, and infrastructure, pointing to a single actor or a shared Phishing-as-a-Service setup. The group reuses the same generic root domain—passkeyhelpdesk[.]com—across multiple target organizations, creating a traceable chain between the extortion fronts. Falcon used the root domain to target at least one organization, with the other handled by Helix. The matching panel templates deployed across multiple DLS listings suggest the actor relies on a single credential harvesting template for all four brands.\n\n## Shared Infrastructure Links the Brands\n\nUNC6671 reuses the same generic root domain across multiple target organizations, creating a traceable chain between the four extortion brands. The root domain, passkeyhelpdesk[.]com, masquerades as passkey-related infrastructure and is appended with victim-specific subdomains for targeted campaigns. Falcon used the root domain to target at least one organization, with the other handled by Helix.\n\nMatching phishing templates are deployed across multiple DLS listings to harvest credentials for each brand. The same panel template appears across all four fronts, suggesting the actor relies on a single credential harvesting template for Redact, Pink, Helix, and Falcon. The shared infrastructure points to either splintered affiliates or a shared Phishing-as-a-Service setup, rather than isolated infrastructure per target.\n\n## ~800 Malicious npm Packages Deliver Cross-Platform RAT\n\nPrecursor Intelligence has identified a cluster of nearly 800 malicious npm packages delivering a cross-platform remote access trojan (RAT) and infostealer targeting Windows, macOS, and Linux. The malware is a supply-chain compromise that drops a full RAT and infostealer on the victim’s machine after installation.\n\nThe npm packages are part of the same campaign as the Metabase zero-day and the UNC6671 rebrand, which the group has been running since May 2026. The actor is UNC6671, a data extortion group previously known as BlackFile, which has rebranded across four new fronts: Redact, Pink, Helix, and Falcon.\n\nApply the latest npm security updates immediately to mitigate the supply-chain attack. The packages are actively delivering the RAT\u002Finfostealer payload, so affected dependencies should be updated or pinned to a known-good version before the next install cycle.\n\n## Metabase SQLi Zero-Day Actively Exploited\n\nA critical SQL injection vulnerability in Metabase, tracked as CVE-2026-63077, was actively exploited in zero-day attacks to breach customer instances at Framework and Tally. The flaw allows an attacker to inject SQL through the Metabase query interface, enabling data exfiltration from the backing database.\n\nReview database access logs for suspicious SQL queries or data exfiltration. Rotate database credentials and review user permissions, then isolate affected Metabase instances from the network until patched.\n\n## Key points\n\n- UNC6671 rebranded from BlackFile in May 2026 and now operates four new DLS brands: Redact, Pink, Helix, and Falcon.\n- The group uses IT helpdesk voice phishing (vishing) to target enterprise employees, posing as mandatory security migration staff.\n- Shared infrastructure across brands includes generic root domains like passkeyhelpdesk[.]com reused across multiple target organizations.\n- Redact published its first DLS blog post on June 27, 2026, explicitly denying pressure from rival groups forced the rebrand.\n- Targeting has expanded to financial services, private equity, and professional services, with data exfiltration from Microsoft 365 and Okta.\n\n## Further reading & sources\n\n- [npm malware cluster, Metabase zero-day exploited](https:\u002F\u002Fdefend.network\u002Fbriefings\u002Fnpm-malware-metabase-exploit-unc6671-rebranding-2026-08-08.html) — defend.network Daily Briefings\n- [UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments | Google Cloud Blog](https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Func6671-targets-financial-services-and-enterprise-cloud-environments)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Func6671-rebrands-as-redact-pink-helix-and-falcon-after-millions-in-vishing-extor.png?v=bbab46fe3b",{"cves":18,"iocs":29,"malware":33,"targets":38,"timeline":44,"industries":49,"technologies":53},[19],{"id":20,"kev":21,"poc":22,"url":23,"cvss":24,"epss":25,"risk_band":26,"risk_score":27,"cvss_version":28},"CVE-2026-63077",true,false,"\u002Fvulnerabilities\u002FCVE-2026-63077",9.8,0.8957,"Critical",89.78,"3.1",[30],{"type":31,"value":32},"domain","passkeyhelpdesk[.]com",[34,36],{"name":35},"AiTM Credential Harvesting Panel",{"name":37},"npm malware",[39],{"name":40,"sector":41,"status":42,"geography":43},"Framework","Technology","confirmed",null,[45],{"date":46,"event":47,"description":48},"2026-06-27","Redact DLS blog post","Redact operators published blog post on DLS",[50],{"url":51,"name":41,"slug":52},"\u002Findustries\u002Ftechnology","technology",[54,57],{"vendor":55,"product":56},"Microsoft","Microsoft 365",{"vendor":58,"product":58},"Metabase","campaign","2026-09-22T07:04:26.729885+00:00","2026-10-16T12:28:16.975972+00:00",{"articles":63},[64,76,87,98],{"slug":65,"title":66,"summary":67,"tags":68,"hero_image_url":73,"story_type":74,"created_at":75},"coinbasecartel-ransomware-group-claims-190-victims-across-17-sectors","CoinbaseCartel Ransomware Group Claims 190 Victims Across 17 Sectors","CoinbaseCartel, a data-exfiltration ransomware group that debuted in September 2025, has accumulated 190 claimed victims across 17 industry verticals, with recent hits on Turner & Townsend, Serruya PE, Sweet Water Holdings, Hitachi High-Tech, CEN\u002FCenelec, MIM Fertility, M.B. Kahn, Xs Cad, Accesso, Caterpillar, Colliers, PanasonicAero, Axiom Global, Demand.io, and Cambridge Mobile Telematics.",[69,70,71,72,12],"ransomware","data-exfiltration","coinbasecartel","dark-web","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcoinbasecartel-ransomware-group-claims-190-victims-across-17-sectors.png?v=ad90ff5f5f","ransomware_incident","2026-09-18T17:05:03.820479+00:00",{"slug":77,"title":78,"summary":79,"tags":80,"hero_image_url":85,"story_type":74,"created_at":86},"inc-ransom-extorted-24-us-law-firms-58-paid-without-a-leak","INC Ransom Extorted 24 US Law Firms; 58% Paid Without a Leak","SOCRadar identified 24 individualized INC Ransom extortion pages for US law firms from a March 2026 campaign, cross-referenced them against INC's leak site, and found only 10 of 24 (42%) listed, implying 14 (58%) paid or are unlisted.",[81,82,12,83,84],"INC Ransom","law firm","leak site","US","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Finc-ransom-extorted-24-us-law-firms-58-paid-without-a-leak.png?v=7e1c94e2e7","2026-08-31T12:15:18.010257+00:00",{"slug":88,"title":89,"summary":90,"tags":91,"hero_image_url":96,"story_type":74,"created_at":97},"chilelocker-raas-profile-updated-with-fresh-dls-onion-and-active-raas-model","ChileLocker RaaS profile updated with fresh DLS .onion and active RaaS model","ChileLocker (ARCrypter) RaaS profile updated with a fresh 2026-04-28 DLS .onion visit and active RaaS model.",[92,93,94,14,95],"ChileLocker","ARCrypter","RaaS","NTRU","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fchilelocker-raas-profile-updated-with-fresh-dls-onion-and-active-raas-model.png?v=51f51c678d","2026-08-27T07:08:37.936162+00:00",{"slug":99,"title":100,"summary":101,"tags":102,"hero_image_url":108,"story_type":59,"created_at":109},"sophos-x-ops-34-confirmed-cases-of-attackers-faking-claude-chatgpt-and-copilot-t","Sophos X-Ops: 34 Confirmed Cases of Attackers Faking Claude, ChatGPT, and Copilot to Drop Malware","Sophos X-Ops analyzed 34 confirmed incidents where attackers spoofed Claude, ChatGPT, and Copilot interfaces to deliver malware through malvertising and infostealer payloads.",[103,104,105,106,107],"The Gentlemen","Sophos X-Ops","AI brand impersonation","malvertising","infostealer","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsophos-x-ops-34-confirmed-cases-of-attackers-faking-claude-chatgpt-and-copilot-t.png?v=7a1343b754","2026-09-30T07:09:51.117027+00:00"]