Welcome to BlackFile Inside a Vishing Extortion Operation

Googles Threat Intelligence Group writes Google Threat Intelligence Group GTIG has continued to track an expansive extortion campaign by UNC6671 a threat actor operating under the BlackFile brand that targets organizations via sophisticated voice phishing vishing and single signon SSO compromise By leveraging adversaryinthemiddle AiTM techniques to bypass traditional perimeter defenses and multifactor authentication MFA Source