Ransomware needs a way in. Stolen credentials are the cheapest one.
redact Ransomware Group
Ransomware group profile
Description
Redact is a cybercrime group that emerged in May 2026, focusing on non-encrypting data extortion following the cessation of BlackFile. It employs sophisticated tactics such as identity compromise, voice phishing, and real-time bypassing of multi-factor authentication to extract sensitive data from high-value corporate targets, primarily in the healthcare, insurance, and financial sectors.
Key insights
- •Redact utilizes voice phishing (vishing) to gain initial access and capture user credentials.
- •They establish persistence in compromised sessions by registering unauthorized MFA devices.
- •Data exfiltration is conducted directly from cloud platforms using native APIs and automated scripts.
- •The group pressures victims by publishing stolen data on a Tor-based leak site.
- •Target sectors include healthcare, insurance, and financial services within the United States.
- •Redact operates as part of a decentralized cybercriminal ecosystem known as The Com.
Threat Level & Status Breakdown
For redact · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for redact in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for redact
- 185.178.208.153
- 38.42.59.171
- 23.234.75.84
- 179.43.185.226
- 193.34.212.132
- 179.43.185.230
- 179.43.171.42
- 31.7.56.61
- 31.7.56.52
- 195.140.213.115
- 195.140.213.114
- 107.128.45.122
- 76.103.148.180
- 47.218.103.146
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for redact
T1110
Brute Force
T1562
Impair Defenses
T1046
Network Service Discovery
T1082
System Information Discovery
T1490
Inhibit System Recovery
T1486
Data Encrypted for Impact
T1021
Remote Services
T1086
T1086
T1078
Valid Accounts
Victims(2)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Hologic | United States | Claimed | about 1 month ago | |
| FCCI Insurance Group | United States | Claimed | about 1 month ago |
Affected countries(3)
Countries where this group has been reported to target or leak victims.