Date: 08/07/2026
Severity: High
Summary
UNC6671 continues its data theft extortion operations under multiple brands, including Redact, Pink, Helix, and Falcon, despite the reported retirement of the BlackFile brand. The group uses IT helpdesk voice phishing (vishing), Adversary-in-the-Middle (AiTM) credential harvesting, and MFA token interception to compromise Microsoft 365 and Okta accounts, enabling large-scale data exfiltration from enterprise cloud environments. Recent campaigns have increasingly targeted the financial services, private equity, and professional services sectors.
Indicators of Compromise (IOC) List
Domains/URLs | myoktasso.com mypasskeysso.com setupssopasskey.com mspasskey.com activatepasskey.com enrollpasskey.com keyokta.com oktaenroll.com oktaportalsso.com passkeyportal.com portalpasskey.com passkeyportalsetup.com addoktapasskey.com deploypasskey.com passkeydeploy.com activatemypasskey.com registerpasskey.com createpasskey.com passkeyadd.com passkeyregister.com passkeycenter.com secureauthpasskey.com passkeyrollout.com setpasskey.com passkeyokta.com passkeyset.com createmypasskey.com newpasskey.com passkeysupport.com sqfepjvmrd.xyz passkeyregistration.com addmypasskey.com passkey-setup.com passkey-portal.com startpasskeysetup.com passkey-connect.com portalsetuphub.com activatepasskeyportal.com assignpasskey.com myconnectkey.com mynewpasskey.com passkeycreate.com oskeyconnect.com passkeycreator.com oskeysync.com enablepasskey.com enablepasskey2fa.com checkpasskey.com passkeyuser.com keysyncos.com myaccountsecurity.com addpasskey2fa.com passkeyenroll.com startpasskey.com passkeyenable.com passkeyactivation.com createmfa.com passkeyhelpdesk.com makepasskey.com add-passkey.com passkey-check.com addyourpasskey.com passkey-enable.com mypasskeyid.com passkeystatus.com secure-passkey.com addssopasskey.com ssopasskey.com createssopasskey.com myssopasskey.com hubpasskey.com passkeymfa.com |
IP Address | 31.7.56.61 31.7.56.52 193.34.212.132 185.178.208.153 23.234.75.84 195.140.213.114 195.140.213.115 107.128.45.122 76.103.148.180 38.42.59.171 47.218.103.146 |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "createpasskey.com" or url like "createpasskey.com" or siteurl like "createpasskey.com" or domainname like "passkeyenroll.com" or url like "passkeyenroll.com" or siteurl like "passkeyenroll.com" or domainname like "setpasskey.com" or url like "setpasskey.com" or siteurl like "setpasskey.com" or domainname like "createmypasskey.com" or url like "createmypasskey.com" or siteurl like "createmypasskey.com" or domainname like "mspasskey.com" or url like "mspasskey.com" or siteurl like "mspasskey.com" or domainname like "makepasskey.com" or url like "makepasskey.com" or siteurl like "makepasskey.com" or domainname like "enablepasskey.com" or url like "enablepasskey.com" or siteurl like "enablepasskey.com" or domainname like "addssopasskey.com" or url like "addssopasskey.com" or siteurl like "addssopasskey.com" or domainname like "addoktapasskey.com" or url like "addoktapasskey.com" or siteurl like "addoktapasskey.com" or domainname like "passkeyregistration.com" or url like "passkeyregistration.com" or siteurl like "passkeyregistration.com" or domainname like "mynewpasskey.com" or url like "mynewpasskey.com" or siteurl like "mynewpasskey.com" or domainname like "oskeyconnect.com" or url like "oskeyconnect.com" or siteurl like "oskeyconnect.com" or domainname like "passkey-enable.com" or url like "passkey-enable.com" or siteurl like "passkey-enable.com" or domainname like "passkeycenter.com" or url like "passkeycenter.com" or siteurl like "passkeycenter.com" or domainname like "checkpasskey.com" or url like "checkpasskey.com" or siteurl like "checkpasskey.com" or domainname like "createssopasskey.com" or url like "createssopasskey.com" or siteurl like "createssopasskey.com" or domainname like "passkeyportalsetup.com" or url like "passkeyportalsetup.com" or siteurl like "passkeyportalsetup.com" or domainname like "oktaportalsso.com" or url like "oktaportalsso.com" or siteurl like "oktaportalsso.com" or domainname like "secureauthpasskey.com" or url like "secureauthpasskey.com" or siteurl like "secureauthpasskey.com" or domainname like "myoktasso.com" or url like "myoktasso.com" or siteurl like "myoktasso.com" or domainname like "passkey-setup.com" or url like "passkey-setup.com" or siteurl like "passkey-setup.com" or domainname like "ssopasskey.com" or url like "ssopasskey.com" or siteurl like "ssopasskey.com" or domainname like "startpasskeysetup.com" or url like "startpasskeysetup.com" or siteurl like "startpasskeysetup.com" or domainname like "mypasskeyid.com" or url like "mypasskeyid.com" or siteurl like "mypasskeyid.com" or domainname like "passkeyportal.com" or url like "passkeyportal.com" or siteurl like "passkeyportal.com" or domainname like "passkeyactivation.com" or url like "passkeyactivation.com" or siteurl like "passkeyactivation.com" or domainname like "passkeyrollout.com" or url like "passkeyrollout.com" or siteurl like "passkeyrollout.com" or domainname like "passkeyhelpdesk.com" or url like "passkeyhelpdesk.com" or siteurl like "passkeyhelpdesk.com" or domainname like "add-passkey.com" or url like "add-passkey.com" or siteurl like "add-passkey.com" or domainname like "keysyncos.com" or url like "keysyncos.com" or siteurl like "keysyncos.com" or domainname like "addyourpasskey.com" or url like "addyourpasskey.com" or siteurl like "addyourpasskey.com" or domainname like "oskeysync.com" or url like "oskeysync.com" or siteurl like "oskeysync.com" or domainname like "oktaenroll.com" or url like "oktaenroll.com" or siteurl like "oktaenroll.com" |
Detection Query 2 : | domainname like "setupssopasskey.com" or url like "setupssopasskey.com" or siteurl like "setupssopasskey.com" or domainname like "activatemypasskey.com" or url like "activatemypasskey.com" or siteurl like "activatemypasskey.com" or domainname like "keyokta.com" or url like "keyokta.com" or siteurl like "keyokta.com" or domainname like "passkey-portal.com" or url like "passkey-portal.com" or siteurl like "passkey-portal.com" or domainname like "myaccountsecurity.com" or url like "myaccountsecurity.com" or siteurl like "myaccountsecurity.com" or domainname like "createmfa.com" or url like "createmfa.com" or siteurl like "createmfa.com" or domainname like "passkeystatus.com" or url like "passkeystatus.com" or siteurl like "passkeystatus.com" or domainname like "enrollpasskey.com" or url like "enrollpasskey.com" or siteurl like "enrollpasskey.com" or domainname like "passkeyokta.com" or url like "passkeyokta.com" or siteurl like "passkeyokta.com" or domainname like "passkey-connect.com" or url like "passkey-connect.com" or siteurl like "passkey-connect.com" or domainname like "activatepasskeyportal.com" or url like "activatepasskeyportal.com" or siteurl like "activatepasskeyportal.com" or domainname like "startpasskey.com" or url like "startpasskey.com" or siteurl like "startpasskey.com" or domainname like "passkeydeploy.com" or url like "passkeydeploy.com" or siteurl like "passkeydeploy.com" or domainname like "passkeyenable.com" or url like "passkeyenable.com" or siteurl like "passkeyenable.com" or domainname like "passkeyadd.com" or url like "passkeyadd.com" or siteurl like "passkeyadd.com" or domainname like "myssopasskey.com" or url like "myssopasskey.com" or siteurl like "myssopasskey.com" or domainname like "portalpasskey.com" or url like "portalpasskey.com" or siteurl like "portalpasskey.com" or domainname like "addpasskey2fa.com" or url like "addpasskey2fa.com" or siteurl like "addpasskey2fa.com" or domainname like "passkeysupport.com" or url like "passkeysupport.com" or siteurl like "passkeysupport.com" or domainname like "secure-passkey.com" or url like "secure-passkey.com" or siteurl like "secure-passkey.com" or domainname like "hubpasskey.com" or url like "hubpasskey.com" or siteurl like "hubpasskey.com" or domainname like "portalsetuphub.com" or url like "portalsetuphub.com" or siteurl like "portalsetuphub.com" or domainname like "mypasskeysso.com" or url like "mypasskeysso.com" or siteurl like "mypasskeysso.com" or domainname like "newpasskey.com" or url like "newpasskey.com" or siteurl like "newpasskey.com" or domainname like "myconnectkey.com" or url like "myconnectkey.com" or siteurl like "myconnectkey.com" or domainname like "activatepasskey.com" or url like "activatepasskey.com" or siteurl like "activatepasskey.com" or domainname like "passkeyregister.com" or url like "passkeyregister.com" or siteurl like "passkeyregister.com" or domainname like "passkeyuser.com" or url like "passkeyuser.com" or siteurl like "passkeyuser.com" or domainname like "passkeymfa.com" or url like "passkeymfa.com" or siteurl like "passkeymfa.com" or domainname like "passkeycreate.com" or url like "passkeycreate.com" or siteurl like "passkeycreate.com" or domainname like "sqfepjvmrd.xyz" or url like "sqfepjvmrd.xyz" or siteurl like "sqfepjvmrd.xyz" or domainname like "addmypasskey.com" or url like "addmypasskey.com" or siteurl like "addmypasskey.com" or domainname like "registerpasskey.com" or url like "registerpasskey.com" or siteurl like "registerpasskey.com" or domainname like "assignpasskey.com" or url like "assignpasskey.com" or siteurl like "assignpasskey.com" or domainname like "passkey-check.com" or url like "passkey-check.com" or siteurl like "passkey-check.com" or domainname like "passkeycreator.com" or url like "passkeycreator.com" or siteurl like "passkeycreator.com" or domainname like "enablepasskey2fa.com" or url like "enablepasskey2fa.com" or siteurl like "enablepasskey2fa.com" or domainname like "deploypasskey.com" or url like "deploypasskey.com" or siteurl like "deploypasskey.com" or domainname like "passkeyset.com" or url like "passkeyset.com" or siteurl like "passkeyset.com" |
Detection Query 3 : | dstipaddress IN ("107.128.45.122","185.178.208.153","195.140.213.114","23.234.75.84","195.140.213.115","76.103.148.180","31.7.56.52","193.34.212.132","38.42.59.171","47.218.103.146","31.7.56.61") or srcipaddress IN ("107.128.45.122","185.178.208.153","195.140.213.114","23.234.75.84","195.140.213.115","76.103.148.180","31.7.56.52","193.34.212.132","38.42.59.171","47.218.103.146","31.7.56.61") |
Reference:
https://cloud.google.com/blog/topics/threat-intelligence/unc6671-targets-financial-services-and-enterprise-cloud-environments