← threat actors
threat actor · not yet in the cluster map
blackfile
also tracked as unc6671 1, falcon 1
2 stories · 1 in the wild · July 23, 2026 – August 8, 2026
evidence: 1 observed · 1 disclosed
how they got in
- phishing email 2 · Aug 8
- voice call 2 · Aug 8
sectors
- finance 1 · Aug 8
- legal 1 · Aug 8
techniques
- aitm 1 · Aug 8
- phishing 1 · Aug 8
- phishing email 1 · Jul 23
- vishing 1 · Jul 23
attack phases seen
- Initial access 2 · Aug 8
- Credential access 1 · Aug 8
what we reported, newest first, grouped by story
Aug 7 – August 8, 2026
- Google/Mandiant tie a 200+ organization extortion spree to UNC6671, which has quietly rebranded from BlackFile into Redact, Pink, Helix, and Falcon. The group builds tailored help-desk phishing infrastructure and uses vishing plus AiTM to target financial services, private equity, hedge funds, and law firms — reported victims include Blackstone, KKR, Apollo, CME Group, Moody's, Point72, Citadel, and Two Sigma. BleepingComputer, SecurityWeek, Reuters
· Aug 8 · observed · via phishing email · as unc6671 · Threat Activity
July 23, 2026
- "FALCON" extortion group profiled — Unit 42 (tracking as CL-CRI-1182) documented a vishing playbook and passkey-themed phishing domains, assessed with moderate confidence as related to BlackFile (Unit 42).
· Jul 23 · disclosed · via phishing email · as falcon · Threat Activity