Pink

Pink is a financially motivated data-extortion brand tracked as CL-CRI-1147 and linked by multiple researchers to the broader UNC6671 / BlackFile / Redact / Helix / Falcon ecosystem. It is also assessed by several vendors as likely affiliated with The Com cybercriminal milieu. Pink emerged in 2026 as a cloud-focused extortion operation that relies on social engineering rather than malware deployment or encryption-based ransomware. Pink commonly gains initial access through voice phishing and fake IT help-desk calls. Operators impersonate internal support staff and direct employees to tailored phishing portals themed around Microsoft Entra ID, passkey enrollment, SSO, or Okta. The phishing infrastructure is designed to capture credentials, MFA factors, and authenticated sessions in real time, including through adversary-in-the-middle workflows and passkey-enrollment lures. Reported kit features include dynamic victim branding, MFA-adaptive flows, anti-analysis checks, backend-controlled gating, and mechanisms intended to keep victims occupied while the attackers log into the real account and enroll attacker-controlled authentication methods. After compromise, Pink targets enterprise identity and SaaS environments, especially Microsoft 365, SharePoint, OneDrive, and in some reporting Okta. The group has been observed stealing data rapidly from cloud repositories, using legitimate account access and built-in automation or scripted collection rather than conventional malware. Post-compromise activity includes sending extortion demands from compromised email accounts and internal collaboration platforms, threatening publication of stolen data on a dedicated leak site. Pink is therefore best characterized as a data-theft extortion actor rather than a traditional ransomware encryptor. Pink has been linked through shared infrastructure, phishing templates, victimology, and operational overlap to BlackFile and Redact, with some assessments describing it as a successor or rebrand after BlackFile’s 2026 shutdown. Google has associated Pink with the UNC6671 cluster and assessed that multiple extortion brands may be used to compartmentalize operations, obscure total victim volume, and isolate negotiations. Reported targeting spans enterprise organizations across healthcare, technology, financial services, transportation, hospitality, manufacturing, real estate, insurance, and other high-value sectors, with a notable emphasis in 2026 on organizations holding sensitive corporate, client, or transaction-related data.