Welcome to BlackFile: Inside a Vishing Extortion Operation

Google Threat Intelligence Group tracks UNC6671's extortion campaign using voice phishing and SSO compromise.

• •Vishing calls impersonate IT, directing victims to credential harvesting sites for real-time MFA interception
• •Man-in-the-middle attacks bypass MFA by registering attacker-controlled devices for persistence
• •Compromised SSO enables lateral movement across Microsoft 365, Okta, SharePoint, and OneDrive
• •Python and PowerShell scripts exfiltrate massive data volumes, using FileAccessed events to evade SOC detection
• •Extortion campaigns escalate from ransom demands to spam, threatening voicemails, and swatting

This summary was automatically generated by AI based on the original article and may not be fully accurate.