Google Threat Intelligence published its analysis of UNC6671 on 7 August 2026. The group used to be BlackFile. It now runs four extortion brands simultaneously — REDACT, PINK, HELIX and FALCON — off one shared set of domains.
The lure is the part worth studying, because it inverts a security message your own organisation has probably been sending.
The call
- Someone rings an employee on their personal mobile, which routes around every corporate control you have.
- They present as IT helpdesk, running an urgent security migration — FIDO2 passkey enrolment, or an MFA update.
- They send the victim to a spoofed portal, on a domain like
[company].createssopasskey[.]com. - An adversary-in-the-middle rig captures the credential and the MFA token in real time.
- The session persists as a legitimate authenticated session.
Then scripts pull data out of Microsoft 365, Okta and whatever else is federated, while the actor deletes password-reset confirmations, security alerts and MFA configuration notices so the victim never sees the trail.
The pretext works because it is the message every security team is currently sending. "We are moving everyone to passkeys, it is more secure, please enrol." A caller offering to help with that is offering to help you do the thing you were told to do.
The domains give the whole thing away
UNC6671 reuses root domains across brands that are supposed to look like separate operations:
| Brand | Domains |
|---|---|
| FALCON | passkeyhelpdesk[.]com · portalpasskey[.]com · addssopasskey[.]com |
| HELIX | passkeyhelpdesk[.]com (shared with FALCON) · oskeysync[.]com · keysyncos[.]com |
| PINK | passkeyms[.]com · mysecurepasskey[.]com · passkeydeploy[.]com |
| BlackFile | setupsso[.]com · idokta[.]com · passkeyuser[.]com |
Google also found identical phishing templates deployed simultaneously across domains, hitting different companies that were later claimed by different leak-site brands.
Every one of those names contains "passkey", "sso" or "okta". A domain-registration monitor for those strings plus your company name is a cheap, high-yield control.
The money
Tracking 18 BlackFile Bitcoin wallets from 7 January to 12 May 2026:
| Total received | 141.65 BTC (~$10.69 million) |
| Opening demand | $1–3 million |
| Typical negotiated reduction | 50–75% |
| Average final payment | $750,000 (~10.2 BTC), in 53% of cases |
Two things follow. The demand is an opening position, and roughly half of victims pay.
The targeting moved up-market
| Period | Sectors |
|---|---|
| Apr–May 2026 | Manufacturing, real estate, healthcare, insurance |
| Jun 2026 | Technology, transportation, hospitality — organisations with IP and source code |
| Jul 2026 | Financial services and legal — private equity, law firms, rating agencies |
The July shift is deliberate. Private equity firms, law firms and rating agencies hold M&A material, capital deployment plans and litigation data. That is information whose value does not depend on encrypting anything — it is worth money to the people it is about, and to people trading against them.
Operational tempo rose to match: 28 root domains at one every 2.2 days in April–May, accelerating to one every 1.6 days by June–July, with seven domains in 72 hours on 20–22 July.
The rebrand story is worth one paragraph
On 11 May 2026 the group announced BlackFile's leak site was shutting down. Operations continued. On 27 June it announced the REDACT rebrand, claiming the BlackFile brand had been "compromised and hijacked by an exiled affiliate" running an unauthorised lookalike site.
Take that as marketing. What it tells you is that the brand is a disposable layer over a stable operation — which is exactly why counting ransomware groups produces wildly different numbers depending on who counts. Four brands here are one crew.
Detection worth implementing this week
In your IdP logs, the sequence that gives it away:
system.multifactor.factor.setup
preceded by user.authentication.auth_via_mfa failures
preceded by abandoned push challenges
An MFA enrolment that follows failed authentications and abandoned pushes is someone else enrolling their factor on the victim's account.
In SaaS logs, exfiltration shows up as FileAccessed events with scripting user-agents — python-requests/2.28.1, WindowsPowerShell/5.1, Go-http-client — or access volumes above any plausible human browsing rate.
In authentication sources, watch for commercial VPN providers (Mullvad, Private Layer) and residential broadband pools (AT&T, Comcast, Charter) diverging from an employee's geographic baseline. Residential proxies are how this crew looks normal.
What actually stops it
- Phishing-resistant MFA, properly. FIDO2 roaming keys, platform authenticators, Okta FastPass. An AiTM portal cannot replay a hardware-bound assertion.
- Tell staff the helpdesk will never call them on a personal phone about passkeys. Name the specific pretext. Generic "beware of phishing" training does not cover a call that sounds exactly like your own rollout.
- Restrict authentication to trusted networks and managed devices. Conditional access on device compliance defeats the session even after a credential is captured.
- Alert on MFA enrolment, always, to a channel the attacker cannot delete from.
- Monitor domain registrations containing "passkey", "sso", "okta" and your brand.
We covered the Teams vishing campaign that reached encryption in under 17 hours last month. Same category, better production values, and now aimed at the firms that hold other companies' secrets.
