BlackFile

BlackFile is a financially motivated data theft and extortion threat group active since at least October 2025, with reported targeting of retail and hospitality organizations since February 2026 and additional impacts across healthcare, technology, transportation, logistics, wholesale, and retail. It is also tracked as CL-CRI-1116, UNC6671, and Cordial Spider, and reporting links it with moderate confidence or likely association to The Com, a loose-knit English-speaking cybercriminal ecosystem. Some reporting also states that Redact was a rebrand of BlackFile, and that Pink was assessed to be a rebrand of Redact. BlackFile conducts voice-phishing and social engineering operations by impersonating corporate IT helpdesk or IT support staff, often using spoofed phone numbers or fraudulent caller ID information. The group directs employees to fake corporate single sign-on or login pages to steal credentials and one-time passcodes, then uses the stolen access to register attacker-controlled devices and bypass MFA. After initial compromise, BlackFile escalates into privileged and executive accounts, including by scraping internal employee directories and conducting additional social engineering. Post-compromise activity includes data theft from SaaS and enterprise platforms including Salesforce, SharePoint, and other internal repositories. Reporting also notes abuse of Microsoft Graph API permissions and access to Salesforce APIs, with attackers operating in ways that mirror legitimate executive sessions. The group prioritizes sensitive files and datasets, including material containing terms such as "confidential" and "SSN," employee phone number datasets, and business records. Stolen data is exfiltrated to attacker-controlled infrastructure, published on a dark web data leak site, and used to support seven-figure ransom demands. Demands have been sent through compromised employee email accounts or Gmail addresses. Some victims and executives have also been subjected to swatting attempts to increase coercive pressure. BlackFile has also been identified as a user of a phishing platform analyzed by Push Security that was used by organized criminal actors including ShinyHunters. That platform supported hybrid vishing and adversary-in-the-middle phishing operations to bypass MFA, steal authenticated sessions, and pivot from identity providers into connected SaaS services such as SharePoint, Salesforce, DocuSign, and Slack for data theft and extortion.