UNC6671

UNC6671 is a cybercrime threat cluster tracked by Google Threat Intelligence Group (GTIG) and Mandiant since early January 2026. GTIG describes it as operating under the BlackFile brand and conducting an expansive extortion campaign focused on sophisticated voice phishing (vishing) and single sign-on (SSO) compromise. Mandiant and GTIG assess UNC6671 is distinct from ShinyHunters/UNC6240, although it has used similar tradecraft and in at least one instance co-opted ShinyHunters branding; GTIG cites separate TOX channels, distinct domain registration patterns, and a dedicated BlackFile data leak site. UNC6671 has targeted dozens of organizations across North America, Australia, and the UK, primarily against Microsoft 365 and Okta environments and other connected SaaS applications. Observed UNC6671 tradecraft includes impersonating internal IT or help desk staff in live phone calls, often to employees’ personal phones, and directing victims to victim-branded credential-harvesting sites that mimic corporate SSO portals. During these sessions, the actor captures usernames, passwords, and MFA codes or approvals in real time, then registers attacker-controlled MFA devices for persistence. Reported phishing infrastructure includes subdomain-based lures such as <organization>.enrollms[.]com, <organization>.passkeyms[.]com, and <organization>.setupsso[.]com, and Mandiant notes UNC6671 commonly used Tucows-registered domains. After access, UNC6671 pivots through compromised SSO into SaaS platforms including SharePoint, OneDrive, Zendesk, Salesforce, and in some cases Okta customer accounts. UNC6671 has been observed searching for sensitive data using terms such as "confidential" and "SSN" and exfiltrating data from SharePoint and OneDrive using Microsoft Graph, python-requests, and PowerShell. GTIG reported the actor repurposed valid session cookies such as FedAuth to fetch file content directly, with activity potentially logged as FileAccessed rather than FileDownloaded. Mandiant specifically noted PowerShell-based downloads of sensitive data from SharePoint and OneDrive. Extortion behavior linked to UNC6671 includes unbranded extortion emails, operation under the BlackFile brand, and aggressive pressure tactics including harassment of victim personnel. The reported activity is described as social-engineering-driven rather than exploitation of vendor vulnerabilities.