BlackFile Ransomware Decryption & Data Recovery

Google Threat Intelligence Group (GTIG) has watched UNC6671's vishing operations since early January 2026. The group launched its leak site on 6 February and adopted the BlackFile name that month. By May GTIG counted dozens of targeted organisations across North America, Australia and the UK. Early victims were in manufacturing, healthcare and insurance; by July the focus had moved to private equity, law firms and rating agencies, with financial services a priority.

Rebrand. The leak site went offline in late April, returned briefly on 11 May with a notice that "BlackFile is shutting down… under this name", and GTIG read that as a transition rather than an end. GTIG later assessed with moderate confidence that the same core intrusion group moved to REDACT as its main brand and spread across further extortion brands including FALCON, HELIX and PINK, tied together by shared infrastructure - one lookalike domain, passkeyhelpdesk[.]com, targeted a Falcon victim and a Helix victim at the same time. Incident-response firm Arete's September report also places Cinder and possibly Vortex in this ecosystem, assessing that they remain interconnected despite claims of independence.

Earnings. Between January and May 2026, 18 BlackFile wallets received 141.65 BTC (about $10.69 million), and payments continued after the shutdown notice. Opening demands typically ran from $1 million to over $3 million, negotiations often cut them by 50-75%, and in more than half of tracked cases final payments averaged about $750,000.

Relationship to ShinyHunters. GTIG's May report states plainly that the operations are independent. UNC6671 borrowed the ShinyHunters brand at least once to make its threats more credible, but it uses separate Tox channels, distinct domain-registration patterns and its own leak site. As early as January, GTIG noted that although UNC6671's tradecraft closely matches UNC6661 (part of the ShinyHunters-branded activity), its extortion email was unbranded and used a different Tox ID, suggesting "separate individuals may be involved".

BlackFile does not encrypt files, so there is no extension and no ransom note file. Look for these signs instead:

Intrusion.

• Employees receive calls on personal phones from "IT" or "the helpdesk" about a mandatory passkey migration or MFA update; more recently the caller ID spoofs the real helpdesk number.
• They are steered to a subdomain carrying the company's name on root domains such as enrollms[.]com, passkeyms[.]com or setupsso[.]com, typically registered through Tucows.
• Right after the employee enters a password and approves MFA, an unknown MFA device appears in the account's security settings.

Data export.

• Access through the Microsoft 365 or Okta SSO dashboard into SharePoint, OneDrive, Zendesk, Salesforce and other apps, with searches for terms such as "confidential" and "SSN".
• Unified audit logs show python-requests or WindowsPowerShell user agents while the ClientAppId is spoofed as Microsoft Office.
• Because files are fetched directly, downloads are often recorded as FileAccessed rather than FileDownloaded, so counting download events badly understates the loss; GTIG recorded one case with more than a million files taken.

Extortion. The demand may arrive from your own hijacked internal email or Teams accounts, with Session as the contact channel and a 72-hour deadline.

Entry is pure social engineering. No exploit and no malware on disk are needed. The operators call employees on personal phones, bypassing corporate security tooling and normal support channels, and use a passkey migration or MFA update as the pretext to send them to a company-branded fake login page.

Real-time MFA capture. The page is an adversary-in-the-middle phishing kit that relays the password to the real SSO provider; once the employee approves the MFA prompt, the operator immediately registers an attacker-controlled MFA device in the security settings for persistence.

Movement and export. With a Microsoft 365 or Okta account in hand, the operator logs into the SSO dashboard and reaches every cloud app tied to it. Export uses Python and PowerShell scripts, the Microsoft Graph API and reused session cookies such as FedAuth, over commercial VPN and hosting infrastructure.

Arete also records the Helix brand using ClickFix lures to trigger PowerShell payloads, so entry methods vary between brands in this ecosystem.

Neither GTIG's reports nor later coverage record BlackFile or its successor brands deploying an encryptor; this is a pure data-theft extortion operation. Its leak site usually posts only limited samples and directory listings, and GTIG has not seen it publish a victim's data in full.

No encryption does not mean less harm: the operators hold cloud-stored business files, contracts and personal data, and they add pressure by harassing staff, flooding mailboxes and threatening executives.