Extortion in the Enterprise: Defending Against BlackFile Attacks

Reported 27 Apr 2026 by otx · Severity: medium

Since February 2026, multiple incidents involving data theft and extortion have been attributed to activity cluster CL-CRI-1116, also known as BlackFile, UNC6671, and Cordial Spider. These financially-motivated attackers, likely associated with "The Com" collective, employ voice-