New Helix Extortion Group Targets Enterprises With MFA Abuse and SharePoint Exfiltration

A previously unreported data extortion operation dubbed “Helix” that targets enterprises using identity-focused entry techniques and automated SharePoint exfiltration.

The group’s playbook combines voice phishing (vishing), device-code phishing to capture session tokens and bypass Conditional Access controls, rapid MFA registration for persistence, and scripted enumeration and bulk download of SharePoint content all staged from shared infrastructure that ties multiple victims to the same campaign.

Helix begins with careful reconnaissance and social engineering. Operators phone targets with convincing pretexts, at times spoofing a direct manager’s name and caller ID to prompt the user to perform a device-code authentication flow.

The victim never types a password; instead the operator captures a session token issued by the identity provider. Sign-ins consistently originate from unmanaged endpoints geo-matched residential proxies or mobile networks to avoid impossible-travel signals.

Once in, the actor rapidly registers a legitimate MFA authenticator on the account to cement persistence; this artifact is deceptively normal and difficult to detect without contextual correlation.

After persistence, Helix transitions from manual discovery to automated collection.

ReliaQuest observed a distinct operational split: interactive browsing from residential IPs and then scripted exfiltration from a hosted IP (179.43.185[.]230) that issued SharePoint searches using the contentclass:STS_Site query and performed mass downloads with a python-requests/2.28.1 user-agent.

ReliaQuest’s investigation links Helix’s methods and hosting patterns to the fragmented ecosystem that produced BlackFile (UNC6671) and ShinyHunters (UNC6661), indicating that names change while tradecraft and infrastructure endure.

That hosted IP is notable hosting proximity and AS data (AS51852, Private Layer INC) place it near IPs previously associated with BlackFile incidents, narrowing the likelihood that Helix is an unrelated newcomer.

New Helix Extortion Group

The operator’s pattern authenticate from benign-looking endpoints, then pivot to a dedicated exfiltration host is a persistent fingerprint across incidents.

ReliaQuest frames Helix as part of a broader fragmentation of the data extortion ecosystem.

BlackFile’s April 2026 shutdown produced successor brands such as Pink and Redact within weeks, and Helix’s emergence continues the trend: different labels but recurring TTPs (vishing, device code phishing, MFA abuse, SharePoint targeting) and shared registrars and hosting providers.

The phishing domain oskeysync[.]com, registered through NICENIC with target-specific subdomains, follows a familiar template seen in earlier campaigns from this ecosystem.

Defenders can materially reduce risk by focusing on identity controls and rapid response. ReliaQuest identifies disabling device-code authentication as the single highest-impact mitigation.

Additional measures include restricting sensitive SaaS access to managed endpoints, blocking newly registered or suspicious domains at the perimeter, and hardening registration flows to make MFA enrollment observable and verifiable.

Detection should prioritize correlated signals: an unfamiliar sign-in followed by a new MFA registration and subsequent SharePoint enumeration from a hosted IP is a canonical Helix sequence.

Operationally, automation matters. ReliaQuest’s GreyMatter telemetry and automated response playbooks demonstrate that terminating sessions, disabling accounts across cloud and on-prem directories, and resetting credentials in seconds can collapse the attacker’s window between capture and bulk exfiltration.

Practically, organizations should instrument identity logs for device-code flows, monitor for contentclass:STS_Site queries and python-requests user-agents against SharePoint, and treat hosted IPs used exclusively for bulk downloads as high-fidelity indicators.

Whether Helix is a direct successor to BlackFile and ShinyHunters or an adjacent actor reusing their playbook, the tactical lesson is unchanged: identity-first operations plus automated cloud collection are now a dominant data extortion vector.

IOCs

Artifact	Type	Details
179.43.185[.]230	IP Address	Exfiltration IP
179.43.185[.]226	IP Address	IP Previously Associated with BlackFile
oskeysync[.]com	Domain	Phishing Domain

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop Accepting SLAs Written for 2019 SOCs – Here’s the 2026 AI SLA Vendor Checklist – Download Free AI SOC SLA Guide