UNC6671 diversifies extortion operations across multiple public brands
Threat Actor Meta
Summary
Hide ▲
Show ▼
UNC6671 has shifted to a multi-brand extortion model, widening its operating footprint across Redact, Pink, Helix, and Falcon and increasing the difficulty of tracking the same intrusion group across separate public labels. The ecosystem shift matters because the same core crew is now linked to help-desk vishing, cloud data theft, and extortion activity against financial organizations. Analysts assess that a single core intrusion group is driving the activity behind these brands, consolidating operations under a flexible public-facing structure.
Related Happenings
Amadey and StealC MaaS ecosystem and affiliate model
Threat Actor Meta
H score73
First: 24.06.2026 18:59
Last: 24.06.2026 18:59
Sources 1
About this happening:
The Amadey and StealC ecosystems now operate as malware-as-a-service (MaaS) offerings, widening access to loader and stealer capabilities for paying customers and affi...
Amadey and StealC MaaS ecosystem and affiliate model
Threat Actor MetaAbout this happening: The Amadey and StealC ecosystems now operate as malware-as-a-service (MaaS) offerings, widening access to loader and stealer capabilities for paying customers and affi...
Amadey and StealC shared-infrastructure malware activity
Malware Activity
H score66
First: 24.06.2026 18:02
Last: 24.06.2026 18:02
Sources 1
About this happening:
The Amadey loader and StealC infostealer are being linked through shared C&C infrastructure, making the pair easier to coordinate and disrupt. Amadey helps attacke...
Amadey and StealC shared-infrastructure malware activity
Malware ActivityAbout this happening: The Amadey loader and StealC infostealer are being linked through shared C&C infrastructure, making the pair easier to coordinate and disrupt. Amadey helps attacke...
DragonForce / Hackledorb pivots from RaaS to a formalized cartel structure
Threat Actor Meta
H score26
First: 18.06.2026 16:30
Last: 18.06.2026 16:30
Sources 1
About this happening:
Hackledorb has pivoted DragonForce from a conventional ransomware-as-a-service (RaaS) model into a formalized cartel structure, signaling a more organized and dura...
DragonForce / Hackledorb pivots from RaaS to a formalized cartel structure
Threat Actor MetaAbout this happening: Hackledorb has pivoted DragonForce from a conventional ransomware-as-a-service (RaaS) model into a formalized cartel structure, signaling a more organized and dura...
O1oo1 packages SilabRAT and AsmCrypt as a dark-web MaaS ecosystem
Threat Actor Meta
H score31
First: 10.06.2026 18:30
Last: 10.06.2026 18:30
Sources 1
About this happening:
o1oo1 is selling SilabRAT as a $5000/month MaaS and bundling it with AsmCrypt, turning the malware into a packaged criminal service that lowers adoption barriers....
O1oo1 packages SilabRAT and AsmCrypt as a dark-web MaaS ecosystem
Threat Actor MetaAbout this happening: o1oo1 is selling SilabRAT as a $5000/month MaaS and bundling it with AsmCrypt, turning the malware into a packaged criminal service that lowers adoption barriers....
BlackFile vishing extortion campaign targeting retail and hospitality organizations
Campaign
H score37
First: 24.04.2026 21:26
Last: 24.04.2026 21:26
Sources 1
How related:
A recent wave of cyberattacks targeting hedge funds, private-equity firms, and other financial organizations has been linked to UNC6671, an extortion group reportedly associated with the BlackFile campaign extortion group.
About this happening:
The BlackFile campaign, also tracked as UNC6671, continues to use vishing and help-desk impersonation to target financial organizations after its earlier retail...
BlackFile vishing extortion campaign targeting retail and hospitality organizations
CampaignHow related: A recent wave of cyberattacks targeting hedge funds, private-equity firms, and other financial organizations has been linked to UNC6671, an extortion group reportedly associated with the BlackFile campaign extortion group.
About this happening: The BlackFile campaign, also tracked as UNC6671, continues to use vishing and help-desk impersonation to target financial organizations after its earlier retail...
Timeline
-
06.08.2026 23:07 2 articles · 1h ago
UNC6671 diversifies extortion operations across multiple public brands
Initial DisclosureA core extortion crew has begun presenting itself through multiple public brands instead of a single campaign identity. The change reflects a more flexible operating model that can obscure attribution while continuing access-theft and extortion activity.
Show sources
- Hedge fund cyberattacks tied to BlackFile-linked UNC6671 extortion group — www.bleepingcomputer.com — 06.08.2026 23:07
- Hedge fund cyberattacks tied to BlackFile-linked UNC6671 extortion group — www.bleepingcomputer.com — 06.08.2026 23:07