The crew behind the BlackFile extortion brand announced its retirement in May. Google's threat analysts say it never left. It simply started posting victims on five different leak sites instead of one.
In an update published on August 6, Google Threat Intelligence Group (GTIG) analysts Tyler McLellan and Austin Larsen tie the BlackFile, Redact, Pink, Helix and Falcon extortion brands to a single cluster of actors they track as UNC6671, which IntelFusions profiles as Redact. The group steals corporate data and demands payment not to publish it, and the way it gets in has barely changed from one brand to the next.
It starts with a call to your personal phone
UNC6671 operators ring employees while posing as the company IT helpdesk, often on their personal mobile numbers so the call never touches a corporate control. In recent cases the callers have spoofed the real helpdesk number to add credibility. The pretext is an urgent, mandatory security migration: turn on FIDO2 passkeys, or re-enroll your multi-factor authentication.
The employee is then walked to a lookalike page, usually the target company's own name added as a subdomain to something plausible such as createssopasskey[.]com. Behind that page sits adversary-in-the-middle infrastructure, a proxy that relays the login to the real site in real time and pockets both the password and the MFA token on the way through. It is the same class of trick behind the fake browser pop-ups hosted on cloud platforms we covered this week. Once the session is live, the actors run automated scripts to pull data out of Microsoft 365 and Okta.
What ties the five brands together
GTIG's case rests on reused infrastructure. The root domain passkeyhelpdesk[.]com was used against one organization later extorted under the Falcon brand and, at the same time, another later extorted under Helix. Domains including addssopasskey[.]com and createssopasskey[.]com carried identical phishing templates, the same code and design hosted simultaneously on different sites. Similar bridges connect BlackFile domains such as setupsso[.]com into the Pink and Helix clusters.
GTIG assesses that a common group of actors is affiliated with all five brands, but leaves room for other readings: splintered affiliates, a shared phishing-as-a-service kit, or the same intruders outsourcing the extortion and negotiation stage to other people.
The targeting moved up market
Domain registrations show a drift toward victims with more to lose. Between April and May 2026 the group registered domains aimed at large manufacturing, real estate, healthcare and insurance firms. In June it shifted to technology, transportation and hospitality. By July the profile had narrowed to financial and legal targets, including private equity firms, law firms and financial rating agencies. The pace picked up too, from one new root domain every 2.2 days in April and May to one every 1.6 days in June and July, with seven domains stood up inside a single 72 hour window from July 20.
The money kept moving after the shutdown notice
Between January 7 and May 12, 2026, GTIG reviewed 18 BlackFile bitcoin wallets that took in 141.65 BTC, about $10.69 million at the time of the transactions. Payments continued past the May 11 leak site shutdown notice, and large cashouts in late April and early May indicate the financial side ran without interruption through the rebrand. Opening demands ran from $1 million to upwards of $3 million, and the operators often settled for reductions of 50% to 75%. In over 53% of tracked cases in that window, final payments averaged $750,000.
What defenders should do
GTIG's guidance is blunt about the fix: phishing-resistant authenticators. FIDO2 security keys, passkeys and platform authenticators bind a credential to a specific domain, which leaves a lookalike page and an AiTM proxy with nothing to replay. That binding is strong, though not a cure-all once a device itself is compromised, as researchers showed when malware stole Google passkeys outright. Beyond that: put business applications behind one SSO platform, shorten sessions so users re-authenticate at least once a working day, restrict logins to corporate networks and managed devices, and alert on sign-ins from commercial VPN and residential proxy pools.
Two detection ideas are worth lifting directly. Query Okta and Entra ID logs for MFA registration events that immediately follow failed authentications or abandoned push challenges. And treat a FileAccessed event as seriously as a download when the user agent names a scripting library such as python-requests, WindowsPowerShell or Go-http-client, or when the volume exceeds normal human browsing.
The full analysis, with the domain list and registration dates, is in GTIG's report. Infrastructure named in it includes passkeydeploy[.]com, oskeysync[.]com and idokta[.]com, alongside hosting addresses 31[.]7[.]56[.]61 and 193[.]34[.]212[.]132. GTIG cautions that most of the IP addresses it observed are commercial VPN nodes and that domains are often used within minutes of registration, so the list reads better as a naming pattern than as a blocklist.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.