BlackFile

UNC6671 Vishing Extortion Rebrands Across 5 Brands UNC6671 vishing extortion group using AiTM credential phishing across five extortion brands

UNC6671 vishing extortion group using AiTM credential phishing across five extortion brands

UNC6671 Vishing Extortion Rebrands Across 5 Brands

Do Son August 12, 2026

At a glance Actor or group UNC6671 (suspected single coordinated group) Activity type Vishing-led data theft and...

Helix Data Extortion Group Emerges from BlackFile, ReliaQuest Reports Helix data extortion group using device code phishing to exfiltrate data from SharePoint

Helix data extortion group using device code phishing to exfiltrate data from SharePoint

Helix Data Extortion Group Emerges from BlackFile, ReliaQuest Reports

Do Son July 16, 2026

At a glance Actor / group Helix (suspected ties to BlackFile and ShinyHunters) Activity type Data extortion...

Inside UNC6671’s “BlackFile” Cloud Extortion Campaigns UNC6671 BlackFile Cloud Attacks AiTM MFA Bypass Okta Microsoft

UNC6671 BlackFile Cloud Attacks AiTM MFA Bypass Okta Microsoft

Inside UNC6671’s “BlackFile” Cloud Extortion Campaigns

Do Son May 20, 2026

A sophisticated identity-centric threat actor operating under the brand “BlackFile” has spent the early months of 2026...

📧

Email Delivery
Get threat intel straight to your inbox.

♾️

Unlimited Vendors
Track every technology in your stack.

🚨

All New CVE Alerts
Be the first to know about new flaws.

⚙️

Custom EPSS Threshold
Filter noise, focus on real risks.

💬

Slack & Teams Webhook
Integrate directly into your SecOps.

🚫

100% Ad-Free
Enjoy an uninterrupted reading experience.

$7/mo

CVE-2026-58138CVSS 9.8
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute...
Admin intel📅 Updated: Sep 20, 2026
CVE-2026-86124CVSS 9.8
AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and...
Admin intel📅 Updated: Sep 19, 2026
CVE-2025-39682CVSS 9.8
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the...
CISA KEV📅 Added to KEV: Sep 18, 2026
CVE-2025-39964CVSS 7.8
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg...
CISA KEV📅 Added to KEV: Sep 18, 2026
CVE-2026-53266CVSS 8.8
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The...
CISA KEV📅 Added to KEV: Sep 18, 2026
CVE-2026-76460CVSS 10.0
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to...
Admin intelCISA KEV📅 Added to KEV: Sep 16, 2026📅 Updated: Sep 16, 2026
CVE-2026-89026CVSS 9.8
The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT...
Admin intel📅 Updated: Sep 16, 2026
CVE-2026-58704
In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This...
Admin intelCISA KEV📅 Added to KEV: Sep 16, 2026📅 Updated: Sep 16, 2026

CVE-2026-86591CVSS 9.8
The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST...
📅 Updated: Sep 21, 2026
CVE-2026-84434CVSS 9.8
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and...
📅 Updated: Sep 21, 2026
CVE-2026-89274CVSS 9.1
The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to,...
📅 Updated: Sep 21, 2026
CVE-2026-92229CVSS 9.1
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable...
📅 Updated: Sep 21, 2026
CVE-2026-70009CVSS 9.3
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker...
📅 Updated: Sep 21, 2026
CVE-2026-10747CVSS 10.0
IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary...
📅 Updated: Sep 21, 2026
CVE-2025-15399CVSS 10.0
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable...
📅 Updated: Sep 21, 2026
CVE-2026-90042CVSS 9.8
In the Linux kernel, the following vulnerability has been resolved: ceph: properly decrypt filenames in vmalloc() buffers The...
📅 Updated: Sep 21, 2026