Pink

Pink, also tracked as CL-CRI-1147, is a financially motivated cybercriminal extortion operation focused on stealing enterprise cloud data and demanding payment to prevent its disclosure. It is associated with the broader UNC6671 activity cluster and shares phishing infrastructure, credential-harvesting templates, and targeting patterns with the BlackFile, Redact, Helix, and Falcon extortion brands. These operational connections do not establish that all brands represent a single organization. Pink participates in identity-focused campaigns that impersonate corporate IT help desks and contact employees on their personal phones. Operators use urgent passkey, multifactor authentication, or single sign-on update pretexts to direct targets to organization-specific phishing portals. Adversary-in-the-middle phishing captures credentials and authenticated sessions, enabling access to Microsoft 365, Microsoft Entra ID, Okta, and connected enterprise services. Pink uses tailored phishing kits and access gates designed to restrict inspection by researchers and automated analysis systems. The associated intrusion playbook emphasizes cloud reconnaissance and automated theft of documents and other sensitive information, particularly from SharePoint and OneDrive. Related operations maintain access through attacker-controlled authentication methods and session persistence, use residential proxies to disguise access, and delete security notifications from compromised mailboxes. Extortion relies on the sensitivity of stolen information rather than file encryption. Campaigns involving Pink have targeted U.S. financial and investment organizations and other enterprises, with private equity firms, law firms, and financial ratings agencies prominent in the broader campaign.