Bird Watching: Characterizing the Infrastructure and Behavior of Falcon-branded Extortion Operations

August 11, 2026
Jason Baker

BLOG

5 min.

Increased attention has been called to a sustained adversary-in-the-middle (AitM) phishing and vishing operation targeting financial services, professional services, energy and technology organizations since at least April 2026. This activity aligns with the threat cluster publicly designated UNC6671 by Google Threat Intelligence Group and O-UNC-045 / CORDIAL SPIDER by Okta Threat Intelligence, operating under extortion brands including Falcon, Helix, Pink and Redact (formerly BlackFile).

TL;DR – A sustained AitM operation has been targeting financial services, legal and other industries since April under extortion brands including Falcon, Helix, Pink and Redact (formerly BlackFile). This blog breaks down the threat actor infrastructure and behavior to inform proactive and retroactive hunts, as well as the threat actor’s standing tactics, techniques, tools and procedures.

Threat actor behavior reflects an emphasis on “big game hunting” or targeting large victim organizations, rather than opportunistic extortion
The operation has involved at least 78 unique victim-targeted phishing subdomains targeting 76 distinct organizations spanning 15 industry sectors
Threat actors authenticate with Okta and pivot to Microsoft 365, Salesforce and other SaaS infrastructure to which their OAuth Token grants them access.

Key Findings

This post aggregates findings from our independent infrastructure analysis with those published by GTIG and Okta and extends the public picture with additional infrastructure, victim targeting data and phishing kit fingerprints not previously published.

Key findings:

The observed behavior, which mirrors similar SaaS-centric targeting from groups such as Shiny Hunters, reflects a departure from opportunistic ransomware deployment and data extortion towards purposeful targeting of large victim organizations, also known as “big game hunting.”
The campaign has been active since at least April 2026, with new infrastructure deployed as recently as last week.
Using data from TRM labs, we have observed over $8 Million USD in payments made across 15 Bitcoin wallets attributed to Falcon, Blackfile, Pink, Helix and Redact during the campaign from April to present. The average extortion payment was approximately $600,000 USD.
We identified 78 unique victim-targeted phishing subdomains across 76 distinct organizations spanning 15 industry sectors. Of these victims, 40% were hedge fund, venture capital, private equity, asset management or other financial services firms.
The actor operates a purpose-built operator console called Work Panel. This is a full cybercrime-as-a-service platform hosted on dedicated infrastructure.
We identified three distinct backend servers on AS51852 (Private Layer INC) serving as AiTM reverse proxies, operator consoles and internal file storage / VoIP coordination infrastructure
The actor’s phishing kit contains multiple high-precision static asset fingerprints enabling reliable detection across both Okta and Microsoft 365 credential-harvesting templates. These phishing efforts are successful when impacting victims without enforced phishing-resistant MFA.
Forensically, the threat group operates similarly to other SaaS-focused data extortion groups such as Shiny Hunters. Once the threat actor has successfully authenticated to a victim’s Okta account using the victim-derived One-Time Password (OTP), they are most frequently observed pivoting to Microsoft 365, Salesforce and other SaaS infrastructure to which their OAuth Token grants them access.
Infrastructure registration is centralized through a single NiceNIC International registrar account, with a consistent registrant identity hash linking phishing domains, C2 backend domains, SMTP infrastructure and operator file storage

Background and Actor Context

UNC6671 / CORDIAL SPIDER is a financially motivated threat actor whose primary objective is bulk cloud data exfiltration followed by data extortion. No encryption or traditional ransomware deployment has been observed as part of these referenced operations. The threat group uses voice phishing (vishing) as its initial access vector. For this attack, callers impersonate IT helpdesk personnel and direct employees to AiTM credential-harvesting pages that transparently proxy real authentication flows, intercepting session tokens in real time and thereby bypassing multi-factor authentication (MFA) entirely.

Google Threat Intelligence previously documented the actor’s diversification across multiple extortion brands following the claimed shutdown of the BlackFile brand in May 2026. It noted that shared infrastructure, phishing templates and victim targeting patterns link these brands to a common operator cluster.

Okta subsequently published a detailed technical analysis of the Work Panel platform itself. They describe it as a multi-tenant cybercrime-as-a-service console with role-based access control, integrated target reconnaissance via commercial B2B data APIs, automated infrastructure provisioning and real-time credential relay management.

Our analysis corroborates and extends both reports.

Campaign Scale and Timeline

Infrastructure and passive DNS analysis reveals a campaign that began no later than April 21, 2026 and remains active at the time of this publication. Key timeline statistics include:

110+ days of observed activity
76 unique root domains registered across the campaign
78 unique victim-targeted subdomains identified across those domains, representing 76 distinct targeted organizations
Peak registration cadence: approximately one new root domain every 1.6 days during June–July 2026 (consistent with GTIG’s published figure)
A notable spike of seven domains operationalized within 72 hours during the week of July 20–22, 2026
New infrastructure registered after the GTIG and Okta publications on August 6–7, 2026, demonstrating the actor’s resilience to public disclosure

The sector distribution of targeted organizations shifted materially over the campaign window:

April–May 2026: Broad targeting across insurance, medical devices, utilities, internet governance and law firms
June 2026: Expansion into media, entertainment, energy and specialist legal practices
July 2026: Narrowing focus toward financial services firms including private equity, hedge funds, credit rating agencies, asset managers
August 2026 (ongoing): Near-exclusive targeting of hedge funds, venture capital firms and financial exchanges, with the most recent infrastructure (registered August 7) targeting insurance brokerage, cybersecurity and commodities trading firms

This progressive focus on organizations holding sensitive deal, portfolio and market intelligence is consistent with GTIG’s observation that the actor appears to be “prioritizing entities whose data maximizes leverage in extortion demands.”

Importantly, we note that this operational focus on deliberate targets, amplified by customized domains and phishing pages, departs from the most common forms of opportunistic ransomware and data theft. It also mirrors the SaaS exploitation focus of other groups, including Shiny Hunters.

Infrastructure Architecture

Phishing Delivery Layer

All observed phishing pages are delivered through Cloudflare CDN (AS13335), which proxies the origin infrastructure and conceals the actor’s backend servers from direct observation. Domains are registered through NICENIC INTERNATIONAL GROUP CO., LIMITED (IANA 3765) for the primary campaign wave, with a secondary cluster registered through Tucows Domains for panel infrastructure.

A consistent NICENIC registrant account identifier links the following infrastructure categories to a single operator account:

All primary phishing domains (passkeymfa[.]com, myssoapps.com and the broader campaign set)
The C2 panel backend domain (sqfepjvmrd[.]xyz)
An SMTP sender domain used for the email channel (aws-us-smtp[.]com, constructed to resemble AWS email infrastructure)
An operator file storage server (ncuqld[.]com, hosting a Nextcloud instance)

Domains use Cloudflare nameservers and are unsigned (no DNSSEC). The TLS certificates are issued by Let’s Encrypt at domain registration time, typically within hours of NICENIC registration.

AiTM Reverse Proxy Infrastructure

Two servers on AS51852 (Private Layer INC) serve as the primary AiTM relay nodes, consistent with GTIG’s published IOC table:

31.7.56[.]61 — Confirmed AiTM reverse proxy; hosts the primary operator Work Panel instance at panel.sqfepjvmrd.xyz
31.7.56[.]52 — Confirmed AiTM reverse proxy; hosts a secondary operator Work Panel instance

Both servers run Caddy as a web server, which handles HTTPS termination and reverse-proxying of phishing traffic to the underlying Node.js processes managed by PM2. This is consistent with the Work Panel architecture described by Okta. Shodan additionally identifies an unidentified proxy-type service responding on port 443, returning HTTP/1.0 400 Bad Request to direct probes. The precise function of this component is not determined from banner data alone and may represent an operator access channel or an artifact of how Caddy responds to unauthenticated probes.

Both servers run Ubuntu 24.04 LTS and expose SSH (OpenSSH 9.6p1). Neither server has appeared in abuse databases or internet scanning datasets, consistent with purpose-provisioned infrastructure under deliberate low-profile operational management.

Operator Server

A third server on the same AS51852 subnet (31.7.56[.]229) runs Debian 13 and hosts:

Nextcloud — a self-hosted file sync and collaboration platform, accessible at ncuqld.com/login. This likely serves as the actor’s internal file repository for credential archives, campaign materials and kit source code.
eturnal — a STUN/TURN server on UDP port 3478, consistent with Nextcloud Talk (Nextcloud’s built-in voice/video feature), suggesting the server may also support internal voice coordination between operators. This is distinct from the outbound vishing calls themselves, which Okta describes as placed through operator-configured external SIP softphone credentials.

Operator Workstation

A fourth Private Layer server (179.43.171[.]18, AS51852) exposes only RDP on port 3389 and runs Windows 11 (Build 26100). The self-signed RDP TLS certificate identifies the hostname as WIN-FTG8SJVH62P, a default auto-generated Windows hostname indicative of a freshly provisioned virtual machine. This server’s exclusive RDP exposure and default Windows configuration is consistent with an operator-accessed remote working environment rather than a phishing delivery or relay node.

Work Panel Console

As described in detail by Okta, Work Panel is a role-based operator console that automates the full vishing campaign lifecycle: target reconnaissance (via RocketReach B2B data API), domain registration (directly through the NICENIC API), phishing site deployment, AiTM session management and credential capture. The platform segregates operators into caller, manager and admin roles, ensuring callers cannot access captured credentials.

We identified three distinct Work Panel deployments across the campaign timeline:

Domain	First Seen	Hosting	Status
betterdays2828199[.]com	2026-04-10	Cloudflare (NameSilo registered)	Earliest known panel
panel.sqfepjvmrd[.]xyz	2026-07-10	31.7.56.61 (Private Layer)	Last seen 2026-07-30; now suspended
panel.whatarewedoingwiththesedomainshello[.]com	~2026-06-03	31.7.56.52 (Private Layer)	Tucows/Njalla registered

The domain name whatarewedoingwiththesedomainshello[.]com, which is registered through Tucows using Njalla privacy nameservers, presents a tongue-in-cheek comment and possible operational security failure. It also provides a unique behavioral signature for this cluster. The Tucows/Njalla/Saint Kitts and Nevis (KN) registration pattern for this domain is shared with at least one other infrastructure domain in the cluster.

Email Infrastructure

A domain constructed to impersonate AWS SMTP relay infrastructure (aws-us-smtp[.]com, registered 2026-04-26) is linked to the same NICENIC operator account as the phishing domains. Consistent with Okta’s description of the Work Panel email channel, this domain serves as the configured SMTP sender for operator-composed phishing pre-texts sent ahead of vishing calls.

Phishing Kit Fingerprints

The Work Panel kit serves two phishing templates depending on the target organization’s identity provider:

Okta template — served at /sign-in/ paths; clones the target’s branded Okta login portal
Microsoft 365 template — served at /common/oauth2/v2.0/authorize/ paths; clones Microsoft’s tenant-branded authentication flow

Both templates share a common backend PHP endpoint (api_FyekIDWY.php) that handles session heartbeating, credential relay polling and AiTM session management. This endpoint is called repeatedly during a victim’s authentication session and produces a static 28-byte JSON response with a deterministic ETag value.

The following fingerprints provide high-confidence detection of Work Panel phishing pages:

Fingerprint	Type	Hits (URLScan)	Template Coverage
api_FyekIDWY.php	PHP endpoint filename	118	Both Okta + M365
API response hash c51eb785...	HTTP response content hash	115	Both Okta + M365
d15faff9a15a05e605bc9cfadacdfb4f16ff2c9d.svg	SHA1-named static asset	70	Okta only
okta-logo-end-user-dashboard.svg	Named static asset	66	Okta only
M365 page hash 275a824c...	HTTP response content hash	34	M365 only

Note on api_FyekIDWY.php: The randomized PHP filename (FyekIDWY) is an artifact of the specific Work Panel build version deployed during this campaign. This filename is not present on any legitimate website in passive scan databases, making it a reliable network detection indicator. The ETag header value W/”1c-xHTlhvqhxGIJKu5AJR5p+il839Y” on responses from this endpoint is equally distinctive and detectable at the network layer without filename inspection.

Sector	Organizations Targeted
Hedge Funds / Quantitative Finance	10
Venture Capital / Private Equity	9
Legal (law firms)	9
Financial Services (diversified)	8
Asset Management	5
Energy	5
Technology / Semiconductors	6
Media / Entertainment	5
Insurance	6
Healthcare / Medical Devices	4
Consumer Goods	4
Transportation / Logistics	2
Other	5

The kit’s static assets share consistent last-modified timestamps indicating the Okta template base was deployed on April 18, 2026, with specific branding layers added on April 20, 2026 and the credential-relay JavaScript (client.js) deployed on April 22, 2026.

Targeting Analysis

Across 110 days of observed activity, we identified 78 unique victim-targeted phishing subdomains representing 76 distinct organizations. Six organizations were targeted on two separate domain deployments, suggesting either initial blocking triggered re-deployment or deliberate parallel infrastructure saturation.

Sector breakdown:

The progressive concentration toward hedge funds, private equity and venture capital firms across the campaign window reflects a deliberate strategic choice. These organizations hold non-public portfolio company data, pending transaction intelligence and investor information. This is all material whose unauthorized disclosure creates strong extortion leverage.

The targeting of nine law firms, including several ranked among the largest in the United States by revenue, is also notable. Law firms represent a high-value credential target because compromised employee sessions provide access not only to the firm’s own data but potentially to privileged client communications, transaction documents and litigation strategy. Several of the targeted firms have active practices in Mergers and Acquisitions (M&A), capital markets and regulatory enforcement, areas where non-public information commands significant value.

The most recent infrastructure cluster (myssoapps.com, registered August 7, 2026 — the day after GTIG’s and Okta’s publications) demonstrates the actor’s operational resilience. New domains were provisioned and active phishing sessions were observed within approximately 24 hours of the cluster’s registration.

Forensic Observations

Forensically, this threat group operates similarly to other SaaS-focused data extortion groups such as Shiny Hunters. Once the threat actor has successfully authenticated to a victim’s Okta account using the victim-derived One-Time Password (OTP), they are most frequently observed pivoting to Microsoft 365, Salesforce and other SaaS infrastructure to which their OAuth Token grants them access.

Post-exploitation compromise has been observed from Private Layer INC (ASN AS51852) infrastructure, consistent with the actor’s preference in back-end infrastructure. Additionally, we have repeatedly observed the threat actor deleting concurrent security warnings delivered by email, almost certainly as an evasive action to prevent user scrutiny of the account abuse or fraudulent logins.

After eviction of successful exfiltration data, the threat actors delivered extortion emails to victims, outlining the alleged breadth of their data exfiltration and directing the victim to contact them via TOX by a pre-set deadline.

Detection and Hardening Guidance

Network Detection

The following indicators provide high-confidence detection with negligible false positive rates:

# HTTP GET/POST requests containing kit PHP backend

uri contains “api_FyekIDWY.php”

# HTTP response ETag matching kit API response

http.response.headers[“etag”] == “W/\”1c-xHTlhvqhxGIJKu5AJR5p+il839Y\””

# Static asset unique to kit (Okta template)

uri contains “d15faff9a15a05e605bc9cfadacdfb4f16ff2c9d.svg”
uri contains “okta-logo-end-user-dashboard.svg”

DNS / Web Proxy Blocking

Block all domains matching the pattern *.passkey*.com, *.mfa*.com, *.sso*.com registered through NICENIC International after April 2026. The full IOC domain list from GTIG provides a comprehensive starting point; this should be treated as a living list given the actor’s demonstrated cadence of new domain registration.
Consider implementing blocks against newly registered domains. Threat actors often operationalize domains shortly after registration to minimize detection windows and this form of block would prevent the domains’ usage against internal employees on-network. A window of <30 days would be sufficient for this control.

Identity and Authentication Controls

GTIG and Okta both provide detailed hardening guidance. The most impactful controls are:

Enforce phishing-resistant MFA (FIDO2/WebAuthn passkeys or hardware security keys). These cryptographically bind authentication to the legitimate origin domain, making AiTM relay ineffective regardless of how convincing the phishing page appears
Restrict authentication to trusted network sources using Okta Network Zones or Microsoft Entra ID Conditional Access
Require managed device enrollment for access to sensitive applications
Reduce session token lifetimes and enforce re-authentication, particularly for privileged access
Alert on MFA registration events preceded by authentication failures or abandoned push challenges, a reliable behavioral indicator of active AiTM session interception

How to Increase Vishing Awareness

Work Panel equips callers with employee contact data including direct phone numbers, job titles and organizational context sourced through commercial B2B data APIs. Employees should be trained to:

Treat any unsolicited call requesting authentication, MFA enrollment or credential entry with suspicion regardless of caller ID
Verify helpdesk identity through a known, independently sourced callback number before taking any action
Understand that legitimate helpdesk staff will never ask them to approve MFA prompts they did not initiate

IOC Summary and Additional Indicators

The full IOC set from GTIG contains 76 phishing domains, 11 network infrastructure IPs and associated scripting user-agent strings. Our analysis extends this with the following additional indicators:

Additional domains (not in GTIG IOC table):

myssoapps.com and subdomains (registered 2026-08-07; active at time of publication)
sqfepjvmrd.xyz (C2 panel backend; NICENIC; now on serverHold)
ncuqld.com (operator Nextcloud server)
aws-us-smtp.com (SMTP sender domain)
betterdays2828199.com (earliest Work Panel instance; NameSilo)
whatarewedoingwiththesedomainshello.com (secondary Work Panel domain; Tucows/Njalla)

Additional infrastructure IPs:

31.7.56.229 — Private Layer operator server (Nextcloud + eturnal VoIP)
179.43.171.18 — Private Layer operator workstation (Windows 11 RDP)

Kit fingerprints (new):

Filename: api_FyekIDWY.php
Filename: d15faff9a15a05e605bc9cfadacdfb4f16ff2c9d.svg
Response hash: c51eb785e771af1ebb7afdfdca05deaa808680c89e51b8c12f1e319482a997fb
Response hash: 275a824ce0ca43d0b48c4e3e11e0c5a47dd09062a0f99cbbf801e20bea01c5bd
ETag: W/”1c-xHTlhvqhxGIJKu5AJR5p+il839Y”

Conclusion

The threat actor tracked as UNC6671 / CORDIAL SPIDER / Falcon has demonstrated sustained operational capability, organizational maturity and rapid infrastructure recovery throughout a 4-month campaign targeting high-value organizations across financial services, legal and technology sectors.

The Work Panel platform first detailed by Okta represents a meaningful evolution in the industrialization of vishing-driven credential theft, packaging target reconnaissance, infrastructure automation and real-time AiTM session management into a single service platform. The separation of duties – callers who know only their next target’s phone number, managers who see the live session queue but nothing else, admins who own the infrastructure – is almost certainly a deliberate organizational design decision that solves the insider risk problem inherent in running criminal operations with hired labor. The Okta report makes this explicit: callers are treated as interchangeable commodity labor, recruited through public underground channels, paid per successful capture and deliberately prevented from accessing the product of their own work.

Despite the new format of these efforts, we observe a continuation of an underlying trend: reduced barriers to entry through increased compartmentalization of efforts. In the same manner by which Ransomware-as-a-Service was made easier through compartmented affiliates, initial access brokers and administrators, we see infrastructure maintenance, targeting and reconnaissance and social engineering execution as distinct functional areas that can be carried out by distinct individuals.

The threat actor’s targeting of MFA-enforced environments without full deployment of phishing resistant MFA is also notable, as victims are generally not technically unsophisticated. Rather, the use of AitM against Okta and M365 targets inconsistent or incomplete deployment of origin-binding cryptography.

The threat actor’s consistent registration patterns, shared infrastructure and reuse of phishing kit assets across the campaign period provide durable detection opportunities that persist despite domain rotation. Organizations in hedge fund, private equity, venture capital and legal sectors, which have featured prominently in the late-campaign targeting wave, should treat this activity as an active and ongoing threat.

References

[1] Google Threat Intelligence Group. “UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments.” August 6, 2026. https://cloud.google.com/blog/topics/threat-intelligence/unc6671-targets-financial-services-and-enterprise-cloud-environments

[2] Google Threat Intelligence Group. “Welcome to BlackFile: Inside a Vishing Extortion Operation.” May 15, 2026. https://cloud.google.com/blog/topics/threat-intelligence/blackfile-vishing-extortion-operation/

[3] Okta Threat Intelligence. “Behind the Scenes of a Vishing Operation.” July 28, 2026. https://www.okta.com/blog/threat-intelligence/behind-the-scenes-of-a-vishing-operation/

This analysis represents findings as of August 10, 2026. The campaign is active and infrastructure observations may change rapidly. IOC data should be verified against current passive DNS and scan databases before operational use.

Jason Baker

Jason Baker manages GuidePoint Security’s Research and Intelligence Team (GRIT), where he oversees and engages in threat intelligence program development, incident response investigations and threat intelligence research on behalf of the firm and its clients. His career background includes strategic intelligence analysis and intelligence program management in the private sector, the Department of Defense and the United States Marine Corps.