THE article discusses the rebranding of the BlackFile extortion group to 'Redact' as reported by Google Threat Intelligence Group (GTIG). The rebrand occurred following the claimed hijacking of the original BlackFile brand by an exiled affiliate, which led to unauthorized extortion campaigns. Despite the change, the group's tactics remained consistent, primarily involving voice phishing (vishing) to target enterprise employees under the guise of IT helpdesk staff.
The GTIG noted that Redact shares infrastructure with other extortion groups like Pink, Helix, and Falcon, using overlapping phishing templates and root domains. New techniques observed include using spoofed helpdesk numbers and compromised emails to reset passwords while evading detection. The group's target focus has evolved over time, shifting from manufacturing and healthcare to financial and legal sectors. GTIG also provided recommendations for organizations to enhance security against such tactics.