Aug 7 – August 8, 2026
- Google/Mandiant tie a 200+ organization extortion spree to UNC6671, which has quietly rebranded from BlackFile into Redact, Pink, Helix, and Falcon. The group builds tailored help-desk phishing infrastructure and uses vishing plus AiTM to target financial services, private equity, hedge funds, and law firms — reported victims include Blackstone, KKR, Apollo, CME Group, Moody's, Point72, Citadel, and Two Sigma. BleepingComputer, SecurityWeek, Reuters · Aug 8 · observed · via phishing email · as blackfile · Threat Activity