Inside UNC6671’s “BlackFile” Cloud Extortion Campaigns

UNC6671, also known as BlackFile, is an identity-focused extortion group that used vishing and adversary-in-the-middle (AiTM) proxy infrastructure to intercept credentials and active session cookies, bypass MFA, and exfiltrate sensitive data from Microsoft 365 and Okta environments across dozens of organizations in North America, Australia, and the UK; the group published stolen data on a data-leak site for extortion before announcing a shutdown of the BlackFile brand, though its methods remain a significant blueprint for future attacks.