Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
77 IOCs
UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments
Threat Actors
Excerpt
Written by: Tyler McLellan, Austin Larsen Introduction Google Threat Intelligence Group (GTIG) continues to track UNC6671 actively conducting compromises leading to data theft extortion, despite the alleged announced retirement of the BlackFile extortion brand in May 2026. Telemetry and infrastructure analysis reveal that rather than disbanding, UNC6671 has diversified its operations across multiple extortion fronts including Redact, Pink, Helix, and Falcon. UNC6671 continues…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →77 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | mynewpasskey.com | High | Score 68/100 | First seen |
| Domain | passkeyadd.com | High | Score 86/100 | First seen |
| Domain | makepasskey.com | Medium | Score 54/100 | First seen |
| Domain | setupssopasskey.com | High | Score 68/100 | First seen |
| Domain | assignpasskey.com | High | Score 58/100 | First seen |
| Domain | activatepasskeyportal.com | Medium | Score 54/100 | First seen |
| Domain | mspasskey.com | High | Score 68/100 | First seen |
| Domain | oskeysync.com | High | Score 65/100 | First seen |
| Domain | ssopasskey.com | Medium | Score 54/100 | First seen |
| Domain | passkeyenable.com | Medium | Score 54/100 | First seen |
| Domain | secure-passkey.com | High | Score 62/100 | First seen |
| Domain | addmypasskey.com | High | Score 68/100 | First seen |
| Domain | passkeyactivation.com | Medium | Score 54/100 | First seen |
| Domain | activatepasskey.com | High | Score 68/100 | First seen |
| Domain | oktaenroll.com | High | Score 68/100 | First seen |
| Domain | activatemypasskey.com | High | Score 68/100 | First seen |
| Domain | passkey-portal.com | High | Score 68/100 | First seen |
| Domain | passkeycreator.com | High | Score 68/100 | First seen |
| Domain | secureauthpasskey.com | High | Score 68/100 | First seen |
| Domain | newpasskey.com | High | Score 68/100 | First seen |
| Domain | createmfa.com | Medium | Score 54/100 | First seen |
| Domain | passkeyms.com | High | Score 58/100 | First seen |
| Domain | add-passkey.com | High | Score 62/100 | First seen |
| Domain | passkeystatus.com | Medium | Score 54/100 | First seen |
| Domain | keyokta.com | High | Score 68/100 | First seen |
| Domain | enablepasskey2fa.com | High | Score 68/100 | First seen |
| Domain | sqfepjvmrd.xyz | High | Score 68/100 | First seen |
| Domain | passkeycreate.com | High | Score 68/100 | First seen |
| Domain | enablepasskey.com | High | Score 58/100 | First seen |
| Domain | portalpasskey.com | High | Score 67/100 | First seen |
| Domain | passkeyregister.com | High | Score 68/100 | First seen |
| Domain | registerpasskey.com | High | Score 68/100 | First seen |
| Domain | oskeyconnect.com | High | Score 70/100 | First seen |
| Domain | mysecurepasskey.com | High | Score 58/100 | First seen |
| Domain | addyourpasskey.com | High | Score 68/100 | First seen |
| Domain | checkpasskey.com | High | Score 68/100 | First seen |
| Domain | passkeycenter.com | High | Score 68/100 | First seen |
| Domain | passkeysupport.com | High | Score 68/100 | First seen |
| Domain | passkey-setup.com | High | Score 68/100 | First seen |
| Domain | enrollpasskey.com | High | Score 68/100 | First seen |
| Domain | setupsso.com | High | Score 58/100 | First seen |
| Domain | passkeyportal.com | High | Score 68/100 | First seen |
| Domain | passkey-enable.com | Medium | Score 54/100 | First seen |
| Domain | addssopasskey.com | High | Score 67/100 | First seen |
| Domain | portalsetuphub.com | High | Score 70/100 | First seen |
| Domain | idokta.com | High | Score 58/100 | First seen |
| Domain | passkeymfa.com | Medium | Score 54/100 | First seen |
| Domain | myconnectkey.com | High | Score 70/100 | First seen |
| Domain | passkey-check.com | High | Score 68/100 | First seen |
| Domain | myoktasso.com | High | Score 68/100 | First seen |
| Domain | mypasskeysso.com | High | Score 68/100 | First seen |
| Domain | passkeyokta.com | High | Score 68/100 | First seen |
| Domain | passkeyregistration.com | High | Score 68/100 | First seen |
| Domain | deploypasskey.com | High | Score 87/100 | First seen |
| Domain | addoktapasskey.com | High | Score 68/100 | First seen |
| Domain | hubpasskey.com | High | Score 68/100 | First seen |
| Domain | startpasskeysetup.com | Medium | Score 54/100 | First seen |
| Domain | passkeyrollout.com | High | Score 68/100 | First seen |
| Domain | passkeyhelpdesk.com | High | Score 72/100 | First seen |
| Domain | myaccountsecurity.com | High | Score 68/100 | First seen |
| Domain | oktaportalsso.com | High | Score 68/100 | First seen |
| Domain | passkey-connect.com | High | Score 68/100 | First seen |
| Domain | createssopasskey.com | High | Score 67/100 | First seen |
| Domain | mypasskeyid.com | High | Score 68/100 | First seen |
| Domain | setpasskey.com | High | Score 58/100 | First seen |
| Domain | passkeyenroll.com | Medium | Score 54/100 | First seen |
| Domain | myssopasskey.com | Medium | Score 54/100 | First seen |
| Domain | passkeydeploy.com | High | Score 87/100 | First seen |
| Domain | passkeyportalsetup.com | High | Score 68/100 | First seen |
| SHA256 | 68a3ad0b80290ff51410cc95d0b1e728d5ffaa933e2230b291bd48fbdc406756 | Medium | Score 53/100 | First seen |
| Domain | passkeyset.com | High | Score 68/100 | First seen |
| Domain | startpasskey.com | High | Score 68/100 | First seen |
| Domain | createpasskey.com | High | Score 68/100 | First seen |
| Domain | passkeyuser.com | High | Score 68/100 | First seen |
| Domain | addpasskey2fa.com | Medium | Score 54/100 | First seen |
| Domain | createmypasskey.com | High | Score 68/100 | First seen |
| Domain | keysyncos.com | High | Score 70/100 | First seen |
IOC Relationship Graph
Building graph…