Key takeaways
- According to public reporting from The Hacker News and Help Net Security, Arctic Wolf disclosed on September 7, 2026 a data theft and extortion cluster it tracks as PREY-0058, which it says shares significant tradecraft with a group Google Threat Intelligence Group tracks as UNC6671 and with extortion brands including BlackFile, Pink, Helix, Cinder, and Redact.
- The chain begins with a phone call. An operator posing as internal IT or help desk sends the target to an authentication-themed page built on the organization’s own name, an adversary-in-the-middle panel captures the credential and the MFA approval, and the resulting session token is replayed through residential proxy infrastructure.
- Arctic Wolf reported no endpoint malware deployment and no network-based lateral movement in this cluster. The final stage is mass collection and exfiltration from SharePoint, OneDrive, Exchange, and Box, followed by an extortion demand sent to the victim.
- The activity mainly targets directors, vice presidents, and other executive staff at U.S. organizations in construction and engineering, healthcare and pharmaceuticals, real estate and property management, finance, and professional services. When an intrusion produces no malware and no lateral movement, the volume and shape of the reads is the only signal that remains.
Arctic Wolf published details on September 7, 2026 of a data theft and extortion cluster it tracks as PREY-0058, and according to public reporting from The Hacker News and Help Net Security, the researchers say the activity shares significant tradecraft with a group Google Threat Intelligence Group tracks as UNC6671. The extortion side has surfaced under several self-assigned brands, among them BlackFile, Pink, Helix, Cinder, and Redact. The naming is the least interesting part. What should hold a security team’s attention is the list of things these operators never bother to do.
They do not drop a payload. They do not move laterally. According to the same reporting, the chain starts on the telephone, with an operator posing as internal IT or help desk walking an executive through what sounds like a routine passkey or MFA enrollment. The link goes to an authentication-themed page built on the target organization’s own name, and behind that page an adversary-in-the-middle panel captures the credential, captures the MFA approval, and lifts the authenticated session token. The token is then replayed through residential proxy infrastructure, so the sign-in that follows arrives from an address that resolves to a home connection. The operators enumerate the account, its applications, and its SharePoint repositories, copy what they find from SharePoint, OneDrive, Exchange, and Box, and send an extortion demand.
Nothing in the chain is an exploit
Every step after the phone call is a supported feature working correctly. A valid token is presented and a valid session is issued. A permitted account browses repositories it is permitted to browse. Files it has rights to are downloaded through the same interfaces that serve them all day. There is no vulnerability to patch here and no signature to write, because at no point does the platform see an operation it was not built to perform.
That is why the campaign is worth studying rather than filing. Most enterprise detection is arranged around the assumption that a serious intrusion leaves artifacts: a binary, a beacon, an unusual east-west connection, a privilege escalation. Strip those away and the security stack has almost nothing to report. Identity said yes at the gate, and after the gate nobody is counting.
The residential-proxy step exists precisely to defeat the one control that might still fire, which is impossible-travel or hosting-provider heuristics on the sign-in. A session replayed from a residential address in the right region looks like the executive checking mail from home. Arctic Wolf’s guidance to block or challenge proxy and hosting traffic in Conditional Access, deploy phishing-resistant MFA, reduce how much a single account can reach in SharePoint, and train help-desk staff to recognize a vishing call is sound, and organizations should act on it. It is also, structurally, a set of gate controls. Gates are worth hardening. They are not worth trusting alone.
The target list tells you what they came for
The reported focus on directors, vice presidents, and executive staff is not about privilege in the administrative sense. It is about content. An executive account in construction and engineering reaches drawings, bids, and contracts. In healthcare and pharmaceuticals it reaches clinical and regulatory material. In real estate, finance, and professional services it reaches deal files, diligence packages, and client records. These accounts are not interesting because of what they can configure. They are interesting because of what they can open.
Because the leverage is the documents themselves, the operators have no reason to encrypt anything. Encryption is loud, it triggers recovery plans, and it hands the victim a clean technical story to tell. Copying quietly and negotiating privately is cheaper for the attacker and considerably harder for the victim, whose first answer to "what did they take" is often that the logs cannot say.
This particular campaign lives in SaaS collaboration stores, but the shape is not specific to them. The same executive documents exist on file shares reached over SMB, NFS, S3, and Web Drive, synchronized from the same laptops and exported into the same working folders. An identity-layer compromise reaches whichever copy is easiest to sweep.
Volume is the signal that survives
When there is no malware and no lateral movement, the reads are the attack. That makes read behavior the control point rather than a forensic afterthought. A session that opens hundreds or thousands of documents it has no working relationship with, at a rate no person sustains, walking a repository in structural order, is behaviorally distinct from that account’s normal week. It is distinct whether the credential was stolen through a fake passkey page or belongs to the person using it, which is why one detection covers both external theft and credentialed insider misuse.
Three controls belong in the data path for that reason. Detection of bulk reads and mass change, assessed per identity against what normal looks like for that identity and that dataset, so a sweep registers as an event instead of as traffic. Attribute-based access control (ABAC) enforced at the file and at the operation, so an account that survives a phishing call does not thereby inherit an entire department’s file estate. And an immutable, per-operation audit record, because the scope question arrives after the attacker has already sent a list of what they claim to hold. Backups and immutable snapshots matter, and they answer a different question: they restore what was changed, and they recover nothing that was copied.
This is the argument behind Cyberstorage, the category Gartner named in July 2021 and that RackTop had already filed its Active Defense patent on in September 2020, ten months earlier. Four U.S. patents now cover the architecture. RackTop BrickStor SP evaluates every operation inline across SMB, NFS, S3, and Web Drive, which is where the on-premises half of the same document estate lives.
None of this is a criticism of the organizations on the receiving end. A convincing phone call from someone who sounds like the help desk, arriving in the middle of a real MFA rollout, will work on competent people at well-run companies, and it will keep working. The architectural question is what happens in the twenty minutes afterward, and whether anything in the environment is positioned to notice that an executive account just read six years of files in one sitting.
Frequently asked questions
- By watching the file operations rather than the endpoint. An intrusion that uses a stolen session token leaves no binary, no beacon, and no lateral movement, so the only anomalous thing it produces is the reading itself: an identity opening far more objects than it normally touches, at a rate no human workflow sustains, across directories outside its working set. Data exfiltration detection at the storage layer measures that per identity and per dataset, and can terminate the session while the copy is still in progress.How storage-layer ransomware detection works
- It raises the cost of the first step substantially and it is worth deploying. It does not change what happens after a session is established, because MFA is evaluated once at authentication and never again during the thousands of file reads that follow. Adversary-in-the-middle tooling exists specifically to convert a successful MFA prompt into a replayable session token, so the practical assumption is that some sessions will be attacker-held and the environment needs a second control that acts on behavior after login.Zero Trust data protection
- An identity control decides whether a session is allowed to begin. A data-layer control decides what that session may do, file by file and operation by operation, and observes what it actually does. Attribute-based access control (ABAC) enforced in the storage path limits how far one compromised account can reach, and an immutable per-operation audit record answers which specific objects were read once an incident is confirmed. The two are complementary, and only the second can answer scope.Attribute-based access control
Go deeper