Full Report
BlackFile’s four affiliate groups are still targeting victims, including medical technology organizations. Several potential victims received new extortion demands last week, according to Google. The post Details emerge on BlackFile’s recent attacks on financial companies appeared first on CyberScoop.
Analysis Summary
# Threat Actor: BlackFile
## Attribution & Identity
- **Name:** BlackFile
- **Aliases:** UNC6671 (Google Threat Intelligence Group), "The Com" (Broad association)
- **Associated Groups:** Redact, Pink, Helix, and Falcon (Brand affiliates/sub-groups)
- **Actor Composition:** Estimated dozen core operators overseeing hundreds of recruited "callers" for initial access operations.
## Activity Summary
BlackFile is a persistent cybercrime and extortion group active since the beginning of 2024. The group operates a "big-game hunting" model, targeting large organizations for high-value extortion. Recently, the group has split its operations into four distinct brands (Redact, Pink, Helix, Falcon) that utilize shared infrastructure. Current activity (August 2026) shows a sustained campaign against the financial and medical technology sectors, with an average of 1.5 new victims targeted daily.
## Tactics, Techniques & Procedures
- **Social Engineering:** Heavily reliant on voice-phishing (vishing).
- **Impersonation:** Callers impersonate IT support staff to deceive employees.
- **Initial Access:** Use of a large network of lower-level "callers" (recruited for small fees) to obtain credentials or access.
- **Extortion Escalation:** Uses aggressive tactics including threatening messages and physical harassment such as "swatting" (calling emergency services to a victim's location).
- **Cloud Targeting:** Known to target enterprise cloud environments.
- **Financial Negotiation:** Initial demands typically start at $3 million, often negotiated down to sub-$1 million figures.
## Targeting
- **Sectors:** Financial Services (Private equity, law firms, financial rating agencies), Medical Technology (Med Tech), Healthcare, Transportation, Logistics, Wholesale, Retail, and Hospitality.
- **Geography:** Primarily focused on U.S.-based large-scale enterprises.
- **Victims:**
- *Observed Infrastructure Targeting:* Blackstone, Bain Capital, Moody’s, CME, and Apollo.
- *Confirmed Impact:* Over two dozen organizations successfully compromised since January 2024.
## Tools & Infrastructure
- **Malware:** Not explicitly named in the article, but associated with data theft and extortion tools.
- **Infrastructure:** Shared infrastructure across Redact, Pink, Helix, and Falcon brands.
- **Vishing Infrastructure:** Hundreds of distributed callers used for high-volume social engineering.
## Implications
BlackFile represents a shift toward highly aggressive, human-centric attack vectors. By leveraging the "The Com" ecosystem—known for blending digital crime with physical threats like swatting—the group increases the pressure on victims to pay. Their ability to pivot across sectors (from retail to finance to med tech) while maintaining a high operational tempo (1.5 victims/day) demonstrates a highly scalable and effective business model that bypasses traditional technical perimeters by exploiting human psychology.
## Mitigations
- **Vishing Awareness:** Implement specialized training for employees to recognize and report suspicious IT support calls.
- **Strict Verification:** Establish out-of-band verification processes for any IT-related requests involving credentials or system access.
- **MFA Hardening:** Move toward FIDO2/WebAuthn-based hardware security keys to mitigate the effectiveness of credential harvesting via vishing.
- **Incident Response:** Ensure IR plans include playbooks for "physical" escalation tactics such as swatting and direct harassment of executives.
- **Cloud Security:** Monitor for unusual access patterns in enterprise cloud environments following suspicious support interactions.