Vishing Call to a Shared Com Ecosystem: Full Methodology and Findings

Figure 19. Table of Registrar distribution against threat actors

SLH and Pink both show direct, convention-specific registrar matches to their own independently documented patterns. BlackFile shows a direct contradiction, not an absence of data, since its own registrars actively exclude Tucows in favour of the same pool SLH uses.

Helix is a partial match on this row simply because it has no multi-domain naming convention in this dataset to test against; this reflects Helix's narrower footprint in the pivoted data generally; note Helix's registrar overlap noted elsewhere in this report rests on Helix's own single documented domain, not on convention-level data, and is weaker evidence for that reason.

The most notable finding overall is the near-identical Dynadot/NameSilo/NICENIC registrar pool shared between the SLH and BlackFile-lineage conventions specifically, despite those conventions otherwise pointing at different naming patterns and different actors. 

4.6 Summary

Across sector, timeline, hosting, and registrar analysis, the incident's own domain sits within the largest, most recently active, and most consistently SLH-aligned cluster in the dataset (helpdesk-/sso-/tickets-), registered during a period of accelerating campaign activity in that specific convention.

The broader dataset, spanning across four distinct clusters supports the Section 3 conclusion that this is shared kit infrastructure used across multiple Com-affiliated actors, rather than a single group's exclusive campaign. Victimology reinforces rather than overturns that conclusion: the overall sector spread matches SLH's documented broad targeting profile, while the two sub-clusters most clearly tied to other actors show narrower, more sector-concentrated targeting consistent with their own separately documented focus areas.

4.7 Unified Cross-Table Summary

This combines the 10 rated rows from Section 3.1–3.3 (INC-01 through KIT-03) with the 5 rated rows added in this section (CONV-01–04, REG-01) for a full 15-row tally.

Figure 20. Table of threat actor mapping scoring totals

Most likely attribution for our incident: Scattered LAPSUS$ Hunters (SLH) remains decisively the best-supported candidate across the full 16-row evidence base: 12 MATCH, 1 PARTIAL, 2 NO MATCH, and 0 NOT DOCUMENTED. The two NO MATCH rows are worth being explicit about, since SLH is not a spotless zero-contradiction candidate: CONV-02 and CONV-03 are the .support and passkey* naming conventions independently and specifically tied to BlackFile and Pink respectively.

KIT-03 (multi-IdP capability) remains the most self-correcting row in this table: it gives Helix its first unambiguous MATCH, on grounds that Helix's documented M365/Entra-only scope is consistent with — not absent from — this kit's actual capabilities, even though Helix still shows no Okta-specific association. Pink strengthens to a clear second place once its own naming convention (CONV-03) and Entra-kit history (KIT-03) are counted in its favour, alongside BlackFile similarly gaining from CONV-02 and its own M365 targeting history. Helix remains the weakest candidate overall, with the most gaps of any candidate by a wide margin but is no longer a near-total blank.

4.7.1 Cross-affiliate Kit Sharing and Scope of Evidence

This attribution should still be presented as tradecraft/infrastructure attribution, not a definitive single-actor claim. Section 4.1 demonstrates that the same underlying phishing kit runs concurrently under naming conventions independently consistent with three different candidates (SLH, BlackFile/UNC6671 lineage, Pink) meaning the kit itself is shared across the broader Com ecosystem, not exclusive even to SLH; SLH's own two NO MATCH rows above are direct evidence of this, not an artifact of the table.

5. Data Leak Site Correlation

Three organisations in the Section 4 target list, Abbott, RingCentral and Ralph Lauren, were confirmed as ShinyHunters extortion victims within days of each other in mid-July 2026 – as demonstrated by the graph below.

Figure 21. STIX graph showing connection between ShinyHunter victims and domain name registrations

5.1 Abbott - Confirmed Extortion, Strong Vector Corroboration

5.2 Ralph Lauren - Confirmed Extortion, Vector Unconfirmed

Confirmed victim on ShinyHunters DLS and tightly timed domain registration, but the reported vector (Salesforce/OAuth compromise) is not confirmed.

5.3 RingCentral - Confirmed Extortion, Vector Unconfirmed

MITRE ATT&CK Mapping

---

Conclusion

This investigation began with a single blocked vishing call and expanded into a dataset of approximately 100 domains, revealing a broader picture of a shared phishing ecosystem operating across multiple Com-affiliated threat actors.

For the specific incident that initiated this investigation, the strongest evidence supports attribution to ShinyHunters. The incident domain aligns with the helpdesk-/sso-/tickets- convention most closely associated with infrastructure independently linked to ShinyHunters elsewhere in the dataset. Abbott's reported intrusion closely matches capabilities directly confirmed within the phishing kit, while RingCentral's appearance within the same convention and registration wave further strengthens this assessment.

For the wider campaign, the evidence indicates a shared infrastructure model rather than infrastructure operated exclusively by a single actor. The same phishing kit appears across at least three naming conventions independently associated with distinct threat clusters. Shared compiled build artefacts provide the strongest evidence linking the SLH convention, while common DOM structures and configuration architecture extend those links to other domain clusters at lower confidence levels.

Attribution associated with the .support convention remains less certain than historical reporting suggests. Registrar analysis identified infrastructure patterns that differ from historically documented BlackFile infrastructure and instead align more closely with the registrar ecosystem used by SLH-linked domains. This raises the possibility that historic naming conventions are continuing under different operators.

From a defensive perspective, the key finding is that the phishing kit itself appears to be shared across multiple actors. Detection and blocking strategies should therefore focus on the kit's behavioural and technical characteristics rather than assuming every matching domain belongs to a single threat actor.

Across the confirmed victim examples analysed in this report, the gap between relevant domain registration activity and subsequent publication on the ShinyHunters data leak site ranged from four to twenty-eight days, averaging less than two weeks where those domains were assessed as potential initial access infrastructure.

Detection must happen inside that window to matter.

Recommendations

Detection & Monitoring

• Block and monitor the full IOC list at email gateway, DNS resolver, and web proxy.
• Treat any organisation appearing in the Section 4 target list as time-sensitive: the observed window between a domain's most recent activity and public DLS listing ranged from 4 to 28 days across the confirmed cases; a slow response risks missing the window entirely.
• Establish (or confirm the maturity of) a standing domain impersonation monitoring capability. Automated detection of newly registered lookalike/brand-plus-keyword domains targeting your organisation, including a specific watch for helpdesk-/sso-/tickets-<yourorg> naming patterns, rather than relying on ad hoc discovery.
• Monitor ShinyHunters and Pink DLS listings as a supply-chain signal. Watch for critical vendors and suppliers appearing.

Vishing-Specific Mitigations

• Restrict what a phone-only caller can achieve at the helpdesk: require a second, independent verification channel (callback to a pre-registered number, video verification, or manager approval) before any MFA reset, device enrolment, or password reset is actioned.
• Train helpdesk and general staff specifically on this pretext pattern: spoofed internal caller ID, urgency framing, "ticket closure" or "mandatory update" language, rather than relying on generic phishing awareness training alone
• Treat a missing/non-existent ticket as an automatic escalation trigger, not a prompt to seek an "alternate way" to access it.
• Move toward phishing-resistant MFA (FIDO2 security keys, or passkeys enrolled only through a verified, pre-authenticated flow).
• Alert on anomalous MFA enrolment events (a new device or method added shortly after a helpdesk interaction) as a standing automated detection rule, not a manual review item.

Indicators of Compromise

https://github.com/Bridewell-CTI/IOCs/blob/main/2026/07/From%20a%20Fake%20IT%20Ticket%20to%20Scattered%20Spider%3A%20Inside%20a%20Com-Affiliated%20Vishing%20Campaign

References

• https://cloud.google.com/blog/topics/threat-intelligence/blackfile-vishing-extortion-operation

• https://www.okta.com/blog/threat-intelligence/vishing-actors-target-microsoft-entra-passkey-enrollment-/
• https://www.securityweek.com/okta-warns-of-vishing-attacks-targeting-microsoft-365-customers/
• https://socradar.io/blog/pink-data-extortion-group-phishing-kits/

• https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
• https://darkatlas.io/blog/scattered-spider-unc3944-a-comprehensive-and-detailed-threat-profile
• https://www.silentpush.com/blog/scattered-spider-2025/
• https://www.bleepingcomputer.com/news/security/scattered-spider-three-things-the-news-doesnt-tell-you/
• https://pushsecurity.com/blog/inside-criminal-phishing-panel
• https://www.theregister.com/2026/01/22/crims_sell_voice_phishing_kits/
• https://lyrie.ai/research/research/scattered-spider-shinyhunters-threat-actor-profile-2026-arrests-evolution
• https://www.obsidiansecurity.com/blog/behind-the-breach-shinyhunters-2026-voice-phishing-campaign

• https://reliaquest.com/blog/threat-spotlight-ransomware-and-cyber-extortion-in-q1-2026/
• https://reliaquest.com/blog/scattered-spider-cyber-attacks-using-phishing-social-engineering-2025/
• https://reliaquest.com/blog/threat-spotlight-helix-new-name-in-data-extortion-ecosystem/
• https://reliaquest.com/blog/threat-spotlight-shinyhunters-data-breach-targets-salesforce-amid-scattered-spider-collaboration/

• https://www.cisa.gov/sites/default/files/2023-08/CSRB_Lapsus%24_508c.pdf

• https://www.bleepingcomputer.com/news/security/abbott-laboratories-probes-two-cyber-incidents-amid-extortion-claims/
• https://cybernews.com/news/abbott-laboratories-breach-shinyhunters/

• https://www.technadu.com/140000-records-leaked-in-ralph-lauren-shinyhunters-salesforce-breach/629660/
• https://haveibeenpwned.com/Breach/RalphLauren
• https://cybernews.com/security/ralph-lauren-data-breach-claims/

• https://ransomware.live/group/shinyhunters
• https://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree
• https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-06-03-Pink-Extortion-Brand-Activity.txt