BlackFile is a financially motivated cybercrime extortion group (not a traditional state-sponsored Advanced Persistent Threat/APT group focused on espionage).

It emerged in early 2026 (activity noted from around January, with sustained campaigns from February) and is tracked under multiple aliases including UNC6671 (Google Threat Intelligence Group / GTIG), Cordial Spider (CrowdStrike), and CL-CRI-1116. Researchers (including Palo Alto Networks Unit 42) have assessed with moderate confidence that it is linked to “The Com,” a loose network of primarily English-speaking cybercriminals associated with extortion, social engineering, violence/swatting, recruitment of young people, and other criminal activity.

The group has primarily targeted organizations in retail and hospitality (with broader impact reported across healthcare, technology, transportation, logistics, and other sectors) in North America, Europe, Australia, and the UK. It has claimed or targeted dozens of victims and demanded seven-figure ransoms (commonly in the $500K–$5M+ range). Unlike classic ransomware groups, BlackFile typically avoids deploying encrypting malware or custom tools. It relies on “living off the land” techniques, social engineering, and abuse of legitimate SaaS APIs and cloud services.

Attack Lifecycle and TTPs

BlackFile’s primary initial access method is voice phishing (vishing):

• Operators place calls from spoofed VoIP numbers or with fraudulent Caller ID Names (CNAM), impersonating corporate IT helpdesk or support staff.


• They claim the call concerns security compliance, system updates, MFA/passkey enrollment, or account verification.


• Victims are directed to highly realistic phishing pages mimicking corporate single sign-on (SSO) portals (Microsoft 365, Okta, etc.).


• Credentials and one-time passcodes/MFA codes are harvested in real time (adversary-in-the-middle / AiTM techniques).

Once credentials are obtained:

• Attackers register their own devices in the victim’s identity provider to bypass subsequent MFA challenges and establish persistence.


• They scrape internal employee directories to identify and further socially engineer high-privilege/executive accounts.


• Lateral movement and data collection focus on SaaS environments (Microsoft 365/Entra, SharePoint, OneDrive, Okta, Salesforce, Zendesk, ServiceNow, etc.).


• Operators search for high-value files using keywords such as “confidential,” “SSN,” “sensitive,” etc.


• Data is exfiltrated via legitimate APIs (e.g., Salesforce API, Microsoft Graph with permissions like Sites.Read.All), browser downloads, or scripted requests (Python with python-requests library or PowerShell). Exfiltration often mimics normal activity (e.g., triggering “FileAccessed” rather than bulk “FileDownloaded” events) and stages data on attacker infrastructure, file-sharing services (e.g., MEGA, LimeWire), or temporary cloud storage.

Extortion phase:

• Ransom demands are sent from compromised employee email accounts, randomly generated Gmail addresses, or (later) hijacked internal accounts/Microsoft Teams.


• Communication initially used Tox, then shifted primarily to the Session messenger (decentralized, privacy-focused).


• Pressure tactics include threats to leak data, limited samples or directory listings posted on their data leak site, spam, threatening voicemails, and swatting (false emergency calls to police targeting employees or executives).

The group launched a dedicated BlackFile data leak site (DLS) on or around February 6, 2026, presenting itself as “security researchers.” It typically posted only limited samples/directory listings rather than full datasets and did not heavily advertise the site. The DLS went offline in late April 2026, briefly reappeared on May 11, 2026 with a message stating that BlackFile was shutting down “under this name,” and has remained inaccessible. Subsequent reporting has noted possible rebranding or successor activity under names such as REDACT or Helix, though attribution remains fluid in the broader ecosystem.

Key Executives / Leadership

No publicly identified key executives, leaders, or named individuals associated with BlackFile exist in open-source reporting.

As an underground cybercriminal operation (and one linked to the decentralized “The Com” network), members operate anonymously. There are no known corporate-style executives, public spokespeople, or court-attributed names specific to this cluster in the available intelligence as of mid-2026. Any claims of specific identities should be treated with extreme caution and verified through official law enforcement or trusted threat intelligence sources.

Websites and Other Indicators of Compromise (IOCs)

BlackFile infrastructure is ephemeral and rotated frequently. No persistent “official” clearnet organizational website is known. Related sites and indicators include:

Phishing / Credential Harvesting Domains (examples of patterns; many are short-lived, organization-specific subdomains often registered via Tucows or similar, themed around “passkey,” “enrollment,” or “SSO”):

• Patterns such as [organization].enrollms[.]com, [organization].passkeyms[.]com, [organization].setupsso[.]com


• Other lookalike SSO/portal domains (e.g., variants mimicking Okta or Microsoft login pages).

Communication / Related Services:

• Session messenger client: getsession[.]org (actors provide Session IDs to victims).


• Early use of Tox; occasional references to Telegram, Discord, or Signal in broader associated activity.

Data Leak Site:

• BlackFile DLS (dark web / Tor-based, exact onion address not publicly disclosed in the reviewed reports; now offline).

User-Agent:

• Python-requests/2.28.1 (commonly observed in API/exfiltration activity; also PowerShell variants such as WindowsPowerShell/5.1).

Additional behavioral indicators include new device registrations in Entra ID / Okta followed by bulk SaaS API activity (especially off-hours), anomalous FileAccessed events in Microsoft 365 Unified Audit Logs, and inbound vishing calls matching helpdesk pretexts.

Note: Full, up-to-date IOC collections are maintained by vendors such as GTIG (available via VirusTotal collections for registered users) and others. Defenders should also monitor for related activity under possible successor brands.

Defensive Recommendations (High-Level)

• Enforce phishing-resistant MFA (FIDO2 / passkeys) wherever possible and restrict device registration.


• Implement strict call-handling policies: verify IT support claims via official channels; limit what can be done in a single call without escalation.


• Monitor identity provider logs for anomalous device registrations, session activity, and API usage.


• Hunt for the listed User-Agents and IP patterns in SaaS and proxy logs.


• Train staff (especially those handling phones or helpdesk) on vishing recognition through realistic simulations.


• Review and restrict high-privilege SaaS API permissions.

BlackFile exemplifies the shift toward identity-centric, malware-light extortion that abuses trusted cloud and collaboration platforms. Organizations in retail, hospitality, and related sectors should treat vishing and SSO compromise as high-priority threats. Information is drawn from public reports by Unit 42 / RH-ISAC, Google Threat Intelligence Group, and corroborating coverage as of mid-2026; threat actor infrastructure and branding evolve rapidly.