PREY-0058

PREY-0058 is a widespread financially motivated cloud data-theft and extortion cluster targeting Microsoft 365 and other SaaS environments, predominantly against directors, vice presidents, executives, and IT personnel at US-based organizations. Its operations rely on IT help-desk impersonation by telephone and text-based vishing rather than exploitation of software vulnerabilities. Operators use adversary-in-the-middle authentication portals to capture credentials, MFA approvals, and authenticated session tokens, then replay stolen sessions through residential proxy services selected to resemble the victim's expected geography and network context. Following account takeover, PREY-0058 enumerates account information, associated applications, Microsoft Entra ID, and SharePoint resources. It performs bulk collection from Exchange Online, SharePoint, OneDrive, and other SaaS platforms including Box. The group uses high-volume mailbox access, document search, file access, and download activity to locate and exfiltrate cloud-hosted data. In some intrusions, it resets passwords or registers new authentication information. No endpoint-malware deployment, data encryption, destructive activity, or network-based lateral movement has been observed in this activity. PREY-0058 conducts encryption-less extortion: after stealing data, it contacts victim executives, typically imposes a short payment deadline, and threatens public disclosure. Its tradecraft substantially overlaps activity tracked as UNC6671. It has also been associated with the BlackFile, Pink, Helix, Cinder, and Redact extortion brands, but these labels do not establish a single confirmed actor identity and may represent rebrands, affiliates, splinter groups, or operators sharing infrastructure.