Precursor Intelligence
Threat News
Latest cyber threat intelligence, breaches and exploitation
4 matching stories
ExtortionUNC6671 Rebrands as Redact, Pink, Helix, and Falcon After Millions in Vishing Extortion
UNC6671, a data extortion group that rebranded from BlackFile in May 2026, has expanded into four new leak site brands — Redact, Pink, Helix, and Falcon — after raking in millions in extortion via vishing campaigns targeting enterprise employees.
CoinbaseCartel Ransomware Group Claims 190 Victims Across 17 Sectors
CoinbaseCartel, a data-exfiltration ransomware group that debuted in September 2025, has accumulated 190 claimed victims across 17 industry verticals, with recent hits on Turner & Townsend, Serruya PE, Sweet Water Holdings, Hitachi High-Tech, CEN/Cenelec, MIM Fertility, M.B. Kahn, Xs Cad, Accesso, Caterpillar, Colliers, PanasonicAero, Axiom Global, Demand.io, and Cambridge Mobile Telematics.
INC Ransom Extorted 24 US Law Firms; 58% Paid Without a Leak
SOCRadar identified 24 individualized INC Ransom extortion pages for US law firms from a March 2026 campaign, cross-referenced them against INC's leak site, and found only 10 of 24 (42%) listed, implying 14 (58%) paid or are unlisted.
New Ransomware Group Linkc Targets H2O.ai with Extortion Claims
A newly identified ransomware operation named Linkc has emerged, claiming to have breached AI and cloud provider H2O.ai and demanding payment in exchange for withheld sensitive corporate information.
