Redact Ransomware Recovery: Vishing, Rogue MFA Devices and Cloud Data Theft

Redact appeared in May and June 2026; AhnLab listed it among the new groups of June. SOCRadar describes it as a data-extortion group that does not encrypt, active since the BlackFile operation stopped. By 3 November 2026 its leak site had listed 9 victims, all in the United States (ransomware.live), but they are large: the group has claimed the medical technology company Hologic, FCCI Insurance Group, the energy companies ONEOK and Eversource Energy, Parker-Hannifin, the law firm Baker Donelson and DexCom. These are the group's claims and not all have been confirmed by the companies.

Reports describe voice phishing: an attacker calls an employee, often posing as IT support, and talks them into approving a login or a password reset. The attacker then registers a multi-factor authentication device of their own on the account, which keeps access after the call ends, and downloads data directly from cloud platforms such as file sharing, CRM and email services. No servers need to be touched, and no encryptor is used.

Review every MFA device registered in your identity platform in recent weeks and remove any your staff did not add, revoke active sessions and tokens, and pull the cloud platform audit logs, which show which records and files were exported. Tell staff that IT will never ask them to approve a login over the phone.

If any systems were also encrypted, keep the encrypted files: we recover databases, virtual machines and backups after ransomware. Contact us for a free assessment. No data, no charge.