DNS Query to UNC6671 (BlackFile) AiTM Credential Harvesting Domain

Matt Brady@mbrady5299

•updated May 18, 2026•2•0•177

Detects network connections or DNS queries to known lookalike domains utilized by UNC6671 (BlackFile) for adversary-in-the-middle (AiTM) credential harvesting and real-time MFA bypass during vishing operations.