BlackFile Group Targets Retail and Hospitality with Vishing Attacks

Palo Alto Networks Unit 42 and RH-ISAC published a report on April 23 detailing BlackFile (activity cluster CL-CRI-1116), a financially motivated extortion group targeting retail and hospitality that uses vishing and credential phishing to register devices and bypass MFA, then abuses legitimate APIs and SSO sessions to scrape and exfiltrate sensitive data from SharePoint and Salesforce before demanding large ransoms.