Redact

Redact is a data extortion and ransomware brand that emerged in the wake of BlackFile’s shutdown in 2026 and is assessed as a possible successor or rebrand within the same criminal ecosystem. Reporting consistently places Redact alongside Pink as one of the brands that appeared shortly after BlackFile’s collapse, with overlapping tradecraft and operational themes, but publicly available information does not establish definitive attribution or organizational structure.

Redact has been publicly associated with ransomware and data-breach incidents affecting U.S.-based organizations, including victims in the healthcare and financial services sectors. Available reporting indicates that the group participates in extortion operations centered on stealing organizational data and pressuring victims to pay under threat of exposure. Its activity is discussed in the broader context of identity-focused extortion crews linked to BlackFile, which relied heavily on social engineering rather than software exploitation.

Redact is frequently referenced as part of a cluster of related extortion brands that includes BlackFile and Pink, and in some assessments sits within or adjacent to the wider ecosystem associated with ShinyHunters and Com-affiliated actors. These links are based on timing, tradecraft overlap, and ecosystem relationships rather than confirmed attribution. High-confidence public reporting supports describing Redact as a likely successor or affiliated extortion brand in the post-BlackFile landscape, but not as a conclusively identified subgroup of any specific actor set.

Known aliases and closely associated brands include redact, BlackFile, and Pink in rebrand or successor discussions.