BlackFile cybercrime group targets financial and med tech sectors

The cybercrime group BlackFile, also tracked as UNC6671, continues to target large-scale organizations across various sectors, including private equity firms, law firms, financial rating agencies, and medical technology companies. Researchers describe the group’s strategy as ‘big-game hunting,’ noting that they specifically avoid small companies in favor of major entities.

BlackFile utilizes social engineering and voice-phishing by impersonating IT support to carry out attacks. The group has recently distributed its extortion operations across four distinct brands that share infrastructure: Redact, Pink, Helix, and Falcon. Recent reports indicate that several organizations received new extortion demands from the Redact brand within the last week.

Extortion demands from the group often begin at approximately $3 million, though researchers have observed that payments are typically negotiated down to less than $1 million.