Details emerge on BlackFile's recent attacks on financial companies
BlackFile (UNC6671), a The Com-linked extortion crew, keeps hitting financial and med tech firms with voice-phishing IT-support scams and ~$3 million demands.
Google Threat Intelligence Group (tracking BlackFile as UNC6671, linked to The Com) reports the extortion group remains active, shifting focus to the financial sector and med tech organizations, with new Redact-brand extortion demands issued last week. The group impersonates IT support in voice-phishing attacks using hundreds of recruited callers, targets large firms in what researchers call big-game hunting, and processes an average of 1.5 new victims daily. Extortion demands start around $3 million and are typically negotiated below $1 million; Flashpoint observed infrastructure targeting Blackstone, Bain Capital, Moody's, CME, and Apollo, though compromise is unconfirmed. Mandiant has responded to more than two dozen BlackFile compromises since January, and victims face escalation tactics including swatting.
- Four brands — Redact, Pink, Helix, Falcon — share infrastructure and are one cluster
- Hundreds of recruited callers pose as IT support; about 1.5 new victims daily
- Demands start near $3 million, typically negotiated below $1 million
- Infrastructure observed aimed at Blackstone, Bain Capital, Moody's, CME, Apollo
- Victims face escalation including swatting; Mandiant engaged by two dozen orgs since January
- Vendors
- GoogleMandiantFlashpoint
From the original article
3 min read at cyberscoop.com
BlackFile’s four affiliate groups are still targeting victims, including medical technology organizations. Several potential victims received new extortion demands last week, according to Google. Silhouette of a man on a phone against window blinds.
By @CyberScoopNews · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.