Falcon — Ransomware Profile

Falcon is a data-extortion brand that the Google Threat Intelligence Group attributes to UNC6671, a vishing-driven crew that emerged in early 2026 under the BlackFile name before diversifying into the Redact, Pink, Helix and Falcon fronts. Per GTIG's August 2026 report, the operators phone employees while impersonating IT helpdesk staff, capture credentials and MFA tokens through spoofed login portals, and steal data from Microsoft 365 and Okta cloud environments, with Falcon-linked infrastructure aimed at financial services, energy and healthcare organizations; SecurityWeek reported the broader operation drew over $10 million in Bitcoin in its first months. In late August 2026 the Falcon data-leak site listed its first publicly tracked claims, naming at least two US companies, medical-device maker Globus Medical and industrial distributor DistributionNOW, as alleged victims.

IntelFusions coverage (5)

Exploit claims SYSTEM access via CrowdStrike Falcon 2026-09-03 · Vulnerabilities
Fake quote emails drop a stealer that kills antivirus 2026-08-18 · Cyber Incidents
Ransomware crews can hide their tracks in ESX logs 2026-08-07 · Ransomware
Extortion crew hides behind five brands, Google says 2026-08-06 · Ransomware
Handala Deploys Wiper Malware Disguised as CrowdStrike Fix During Global Outage 2026-02-16 · Cyber Incidents

Recent claimed victims

Read the full analysis on IntelFusions