Private Equity, Law and Ratings Firms: BlackFile Vishing Extortion Campaign

Google Threat Intelligence Group (GTIG) has confirmed that the extortion crew publicly known as BlackFile, which it tracks as UNC6671 and associates with the wider Com ecosystem, is actively breaching private equity firms, law firms and financial ratings agencies, and was still hunting new victims as of late last week. In a report published August 6, 2026, GTIG says the group did not retire when the BlackFile brand announced its shutdown in May 2026, but instead diversified across four extortion fronts sharing infrastructure: Redact, Pink, Helix and Falcon. Several organizations received fresh extortion demands from the Redact brand within the past week, according to Google. Researchers put the group's operational tempo at an average of 1.5 new victims per day, with demands that typically open around $3 million and are frequently negotiated down to under $1 million, including several payments in the past few weeks.

What Happened

The core of the campaign is straightforward and has not changed in months: tailored IT helpdesk voice phishing, adversary in the middle (AiTM) credential capture, and bulk data theft from cloud tenants, followed by an extortion demand. What changed is the target list and the branding.

GTIG's own account (the PRIMARY source here) describes UNC6671 as a single core intrusion group driving helpdesk vishing and cloud data theft across all of the public brands. SecurityWeek reports that the Redact data leak site launched in June 2026 with a claim that the BlackFile operation had been "hijacked by an affiliate," a story GTIG's infrastructure analysis does not support. GTIG hedges appropriately: the overlaps support a common group of actors behind BlackFile, Redact, Pink, Helix and Falcon, "although other scenarios such as splintered affiliates or shared Phishing-as-a-Service infrastructure may also be plausible."

SC Media summarizes GTIG's sector rotation over roughly four months:

• April to May 2026: manufacturing, real estate, healthcare and insurance, focused on high volume credential harvesting.
• June 2026: technology, transportation and hospitality, focused on intellectual property, source code and VIP client data.
• July 2026: financial and legal, private equity, law firms and ratings agencies, focused on M&A, capital deployment and litigation material.

CyberScoop adds that targeting has since broadened again, quoting GTIG principal threat analyst Austin Larsen: "We have seen continued targeting against the financial sector with additional targeting of other organizations including in the med tech space."

Accounts differ on the group's origin. BleepingComputer states BlackFile first emerged in February 2025 with a wave of attacks on retail and hospitality organizations. SecurityWeek says the actor emerged in early 2026 under the BlackFile name, and CyberScoop describes it as active "since the start of the year." That is a roughly twelve month discrepancy in the group's stated lifespan, and the sources do not reconcile it. What all of them agree on is that GTIG issued a public warning in May 2026 about dozens of targeted organizations across North America, Australia and the UK.

What Was Taken

This is where the reporting is thinnest, and it should be treated that way.

No named victim has confirmed a successful data theft. GTIG's technical description is that once session persistence is established, the actors deploy automated scripts to exfiltrate data from enterprise cloud environments including Microsoft 365 and Okta. Larsen told Cybersecurity Dive that "once they establish initial access, they use automated scripts to exfiltrate vast corporate data repositories and then issue extortion demands." That is a description of capability and observed tradecraft, not a per victim inventory.

On the named financial firms, accounts are consistently negative or unresolved:

• Reuters, citing Google and internet intelligence data, reports the actors built 72 malicious websites targeting employees at firms including Blackstone, Apollo and KKR, and states plainly that it could not establish whether any attempted hacks were successful.
• Flashpoint researchers told CyberScoop they observed malicious infrastructure targeting Blackstone, Bain Capital, Moody's, CME and Apollo, but that it is unclear whether any of those firms were compromised.
• BleepingComputer, following Reuters and Bloomberg reporting, names Point72 Asset Management, Millennium Management, Two Sigma Investments and Citadel among targeted firms. Point72 reportedly told investors it was attacked but found no evidence client data was stolen. Two Sigma said it blocked an attempted intrusion and found no indication its systems or data were affected. Millennium and Citadel declined to comment.

The two named victim lists overlap but are not identical, and neither is a breach list. The honest read: infrastructure targeting these firms is documented, successful compromise at any specific named firm is not.

By sector, the data at risk is the point. GTIG and SC Media both frame the July pivot as a deliberate hunt for M&A documentation, capital deployment plans, litigation files and confidential corporate material, precisely the categories that maximize leverage in a negotiation.

Why It Matters

Three things make this campaign worth an emergency read for anyone defending a financial or professional services firm.

Brand tracking is now actively misleading. Denis Calderone, CTO at Suzu Labs, told SC Media that SOC teams need to stop tracking brand names and start tracking behaviors, noting that GTIG's infrastructure analysis shows the same phishing templates and shared domains connecting all five brands. A detection rule or threat feed keyed to "BlackFile" went blind in May and stayed blind while the same operators kept working under four new names.

The economics favor the attacker. Larsen told CyberScoop this is deliberate big game hunting: "BlackFile does go after some of the largest organizations in the sectors that they go for. They're not going after small companies." At roughly 1.5 new victims a day, with demands opening near $3 million and settling under $1 million, the model is volume plus leverage rather than a single spectacular payday.

Escalation is physical. CyberScoop reports that some recent victims have faced threatening messages and other escalation including swatting incidents, a tactic adopted by several subsets of The Com. Incident response plans for these firms need a personal safety and executive protection track, not just a legal and comms track.

The Attack Technique

Per GTIG, the intrusion chain is consistent across every brand:

1. Vishing to personal devices. Operators call employees while posing as IT helpdesk staff facilitating a "mandatory, urgent security migration." GTIG specifically notes the actors often contact employees on their personal mobile phones, outside corporate telephony, MDM and monitoring.
2. Spoofed portal and AiTM. The call directs the target to a spoofed login portal fronted by adversary in the middle infrastructure that intercepts credentials and MFA tokens in real time. Calderone describes the phishing domains as passkey themed, weaponizing the language of stronger authentication to sell the pretext.
3. Session persistence. With a live session established, MFA is no longer a barrier; the attacker inherits an authenticated identity rather than replaying a static credential.
4. Automated cloud exfiltration. Scripted collection against Microsoft 365 and Okta. Calderone specifies python-requests and PowerShell as the observed tooling for automated exfiltration.
5. Multi-brand extortion. Data theft only, with the demand issued under whichever front brand is in rotation. There is no encryption stage in the reporting.

Note that no zero day or novel malware appears anywhere in this chain. As Undercode News puts it, the group focuses on "something much more difficult to patch: people." That framing is theirs, but it matches what GTIG describes.

What Organizations Should Do

1. Move to phishing resistant authentication and mean it. FIDO2 or hardware backed passkeys with origin binding break the AiTM proxy step outright. Push notification, OTP and SMS MFA are all defeated by this chain. Note the irony that the lures are passkey themed, so user education must cover what a legitimate passkey enrollment actually looks like in your environment.
2. Kill the helpdesk voice channel as an identity proof. Establish an out of band verification procedure for any password, MFA or SSO change request, and publish it widely: real IT will never call a personal mobile to run an urgent migration. Require callback through a known internal number or an in app verification the employee initiates.
3. Hunt on behavior, not brand. Build detections around the actual TTPs: new device or impossible travel session registrations, MFA re-enrollments shortly after a login from unfamiliar infrastructure, and bulk Graph or Okta API reads from python-requests or PowerShell user agents. Names like Redact, Pink, Helix and Falcon will change again.
4. Instrument cloud exfiltration paths. Alert on anomalous volume in Microsoft 365 (SharePoint, OneDrive, Exchange mass export) and Okta admin API enumeration. GTIG's chain hinges on automated bulk collection after access, which is the loudest stage available to you.
5. Shorten session lifetimes and enforce continuous access evaluation. Session persistence is the pivot point here. Aggressive token lifetimes, device compliance conditional access and CAE revocation on risk signals reduce the window between credential theft and data loss.
6. Plan for escalation, including swatting. Given the documented harassment and swatting against victim personnel, brief executives and named employees, coordinate in advance with local law enforcement where possible, and treat personal device and personal contact information hygiene as part of the security program.
7. Prioritize deal and litigation repositories. If you hold M&A, capital deployment or litigation material, apply tighter access review, DLP and egress alerting there first. That is explicitly what this actor came for in July.

Sources: Details emerge on BlackFile's recent attacks on financial companies... | UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets ... | Hedge fund cyberattacks tied to BlackFile-linked UNC6671 ... | Vishing Extortion Group UNC6671 Rebrands After Making ... | Vishing group UNC6671 now focuses on extorting M&A firms news SC... | Hackers targeted US private equity, other firms including ... | BlackFile’s Financial Sector Offensive Is Growing: Inside the Cyber... | Former BlackFile affiliates linked to extortion campaign ...