other
Adversary-in-the-middle extortion operation running brands including Falcon, Helix, Pink, Redact, and BlackFile; GuidePoint traced over $8 million across 15 Bitcoin wallets with a $600,000 average extortion amount.
No evidence-backed relationships are recorded.
GuidePoint says the persona offering to delete stolen data for $20,000 to $60,000 is very likely a ransomware affiliate, which makes the rescue fee a second payment to the same attacker.
Perspective Coverage
3 publishersReality
Arctic Wolf says the cluster it tracks as PREY-0058 deploys no malware at all. A call from fake IT leads to a proxied login page, and the stolen session token comes back from inside the victim's own ASN.
Perspective Coverage
3 publishersReality
Microsoft has tracked passkey- and SSO-themed help desk impersonation since May 2026, with the calls steering employees into adversary-in-the-middle proxies and device-code grants that hand over live Microsoft 365 sessions.
Perspective Coverage
6 publishersReality
The private equity firm's 21 August notice puts cloud access at 6 to 10 July and the scope finding at 12 August. The interval nobody puts on a dashboard sits in between.
Reality
Google says the BlackFile crew has targeted dozens of organisations by phoning staff and posing as internal IT. No vendor bug is involved, which puts the remedy on IT leadership.
Reality
Google Threat Intelligence Group says the crew behind BlackFile spread into Redact, Pink, Helix and Falcon while keeping the same vishing route into Microsoft 365 and Okta.
Reality