Helix
Helix is a ransomware group, tracked by Brandefense. It targets 11 sectors, including Technology and Finance, in the United States and Canada. It uses 5 MITRE ATT&CK techniques.
- UNC7761
- Techniques
- 5
- Exploited CVEs
- No CVE data
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
5 techniques across 4 of 14 tacticsReconnaissance·
Resource Development·
Execution1
Data from Information Repositories: Sharepoint
Persistence1
Account Manipulation: Device Registration
Privilege Escalation·
Defense Evasion·
Credential Access1
Steal Application Access Token
Discovery·
Lateral Movement·
Collection·
Command and Control·
Exfiltration·
Impact·
Arsenal · Malware And Tools.
- Helixmalware
- python-requests/2.28.1tool
About Helix.
Helix is a data-extortion brand that appeared in mid-2026 and runs its own Tor leak site; its first listings, including Uber Freight, date from early August 2026. It gains access through vishing and device-code phishing against Microsoft 365, registers its own MFA device for persistence and exfiltrates SharePoint data in bulk with automated scripts.
ReliaQuest and Google Threat Intelligence Group link it to the BlackFile/UNC6671 cluster alongside Redact, Pink and Falcon; the relationship is unconfirmed and Redact denies it.
Last updated Nov 3, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.