UNC6671 is a data extortion group known for using vishing (voice phishing) to target enterprise employees, often via personal mobile devices. They impersonate IT help desk staff to trick victims into AitM phishing pages, capturing credentials and MFA tokens. The group operates under multiple extortion brands including BlackFile, Redact, Pink, Helix, and Falcon, and has been active since January 2026, targeting organizations in North America, Australia, and the U.K.