New Extortion Brand Uses IT Impersonation to Breach Organizations

A newly surfaced extortion group dubbed "Pink" is using vishing and fake helpdesk calls to harvest credentials and bypass MFA, then quickly exfiltrating data from services such as SharePoint and OneDrive to support extortion; Unit 42 and reporting link Pink to prior groups (BlackFile, Redact) and the broader "The Com" network, with domain reuse and DDoS-Guard hosting noted.