UNC 6671, a vishing extortion group, has rebranded from 'BlackFile' to multiple new names and continues to conduct sophisticated voice phishing attacks targeting organizations in North America, Australia, and the UK. The group has utilized adversary-in-the-middle (AiTM) techniques to compromise Microsoft 365 and Okta infrastructures, deceiving employees into revealing credentials and multi-factor authentication tokens.
UNC6671 has also launched a new data leak site as part of its operations and has garnered over $10 million in Bitcoin ransom payments. Its tactics have evolved, including spoofing legitimate helpdesk numbers and using compromised email accounts to reset passwords, while maintaining consistent operational methods despite its rebranding.