UNC6671 Rebrands and Diversifies Vishing Operations

UNC6671, a financially motivated threat group previously operating under the 'BlackFile' brand, has diversified into multiple extortion fronts including Redact, Pink, Helix, and Falcon. Despite claiming retirement in May 2026, the group remains highly active, leveraging voice phishing (vishing) directed at employees' personal devices. They impersonate IT helpdesks to lure victims to Adversary-in-the-Middle (AiTM) phishing portals that bypass multi-factor authentication (MFA) to gain access to enterprise SaaS environments like Okta and Microsoft 365.

Technical analysis of their infrastructure reveals a centralized ecosystem of specialized panels, including vishing management platforms, Cloudflare account automation tools (CF-Suite), and cryptocurrency vault drainers targeting Coinbase and Binance. These panels facilitate real-time monitoring of victim sessions, automated domain registration via NiceNIC, and programmatic data exfiltration using scripting libraries. The group has shifted targeting from broad enterprise verticals toward high-value sectors such as private equity, law firms, and financial rating agencies to maximize extortion leverage.

This activity represents a significant risk to organizations relying on traditional MFA. The group's ability to spoof helpdesk numbers, utilize residential proxies to blend with legitimate traffic, and systematically delete security alerts makes detection challenging. Organizations are urged to move toward phishing-resistant FIDO2 authenticators and implement strict session-binding controls to mitigate these persistent identity-centric attacks.