MEDIUMVulnerability
Global

Financial Services Under Fire From Rebranded Extortionists

·Source: Bank Info Security

Updated:

Executive Summary

What's in a Name? Vishing-Savvy BlackFile Rebrands as Redact, Pink, Helix, Falcon Data theft extortion group BlackFile claimed retire in May. Threat researchers at Google said telemetry and attack infrastructure sho

Analysis

What's in a Name? Vishing-Savvy BlackFile Rebrands as Redact, Pink, Helix, Falcon Data theft extortion group BlackFile claimed retire in May. Threat researchers at Google said telemetry and attack infrastructure shows that the group has carried on using a variety of new brand names and shifted its focus to targeting financial services.

Indicators of Compromise (2)

URL (1)
https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/financial-services-under-fire-from-rebranded-extortionists-image_small-5-a-32464.jpg
VirusTotalURLhaus
Domain (1)
ismg-cdn.nyc3.cdn.digitaloceanspaces.com
VirusTotalURLhaus
Source Attribution

Originally published by Bank Info Security on Aug 7, 2026.

Related Threats

MEDIUMVulnerabilityNEW

AI Sandbox Failures Expose Need for Continuous Monitoring

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/ai-sandbox-failures-expose-need-for-continuous-monitoring-image_small-2-a-32481.jpg" align=right hspace=4>The fallout from the Hugging Face security incident continues with more artificial intelligence labs revealing that their models and agents either accessed the internet or escaped isolated test environments to hack into other

Bank Info Security
MEDIUMVulnerability

Friday Squid Blogging: Arctic Bobtail Squid Video

Nice video of the Arctic bobtail squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven&#8217;t covered. Blog moderation policy.

Schneier on Security
HIGHVulnerability

NVD HIGH: CVE-2026-19231 — A security flaw has been discovered in SourceCodester Simple Doctors Appointment...

A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete_appointment. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-19231
NIST NVD