The BlackFile Ransomware Group Isn’t Gone — It Just Changed Its Name

The BlackFile ransomware hacker group once announced it was shutting down operations. Google Threat Intelligence discovered that it continues to launch attacks under a new name, Redact.

Key points to know:
• The same group operates under multiple names: BlackFile, Redact, Pink, Helix, and Falcon
• Entry method: Impersonating IT Helpdesk staff over phone calls, claiming an urgent security update is required
• They direct victims to fake websites, stealing both passwords and 2FA codes
• Google tracked them down because they reuse domains such as passkeyhelpdesk[.]com

[Insight: Criminal groups don’t easily disappear — they merely rebrand. An incoming call claiming to be “Company IT” asking for codes is a scam signal. Hang up and call back using official numbers.]