other
Extortion crew tracked by Google Threat Intelligence Group as UNC6671 and associated with The Com; active since the start of the year, using IT-support impersonation vishing for initial access and running four extortion brands on shared infrastructure.
No evidence-backed relationships are recorded.
Google says UNC6671 split its extortion into Redact, Pink, Helix and Falcon on shared infrastructure while still working finance, legal and med tech. It averages 1.5 new victims a day.
Reality
The firm says intruders reached its cloud platforms in July and took names, birth dates and Social Security numbers. Google attributes the campaign to BlackFile, a Com affiliate with four extortion brands.
Reality
Intel 471's 18-month sweep of the underground counted 340 financial-sector extortion victims across 74 countries, 159 firms with access for sale and 562 claimed DDoS attacks. The dated intrusions came in through vendors and help-desk calls.
Reality
Google says the BlackFile crew has targeted dozens of organisations by phoning staff and posing as internal IT. No vendor bug is involved, which puts the remedy on IT leadership.
Reality
Google Threat Intelligence Group says the crew behind BlackFile spread into Redact, Pink, Helix and Falcon while keeping the same vishing route into Microsoft 365 and Okta.
Reality