Social Engineering Targets Healthcare Through Phishing, BEC and Help-Desk Calls
Summary
Healthcare organizations face phishing, business email compromise and vishing that can expose patient data or disrupt care. The article discusses FBI and HHS warnings and recommends layered defenses including MFA, security awareness training and monitoring.
Key points
- The article describes phishing, SMSishing, business email compromise (BEC) and vishing as ways to steal credentials, deliver malware, redirect payments or access healthcare data.
- The article says the FBI alerted the American Dental Association to a campaign targeting oral surgeons with fake patient forms sent as malware-bearing attachments.
- It says HHS warned healthcare organizations that callers posing as finance staff may target IT help desks to enroll attacker-controlled devices and seek access to systems or patient data.
- Huntress says its internal analysis for its 2024 Cyber Threat Report found that nearly 35% of Microsoft 365 threats in healthcare involved malicious inbox rules.
- The article recommends layered defenses, including multi-factor authentication, security awareness training and managed detection and response.
- In a case described by Huntress, its SOC found suspicious inbox rules in a CEO's account; Huntress says it removed the rules and reinstated MFA, while the CEO's bank reported attempts to add users to the account.
Article Details
- Topic
- Social engineering threats targeting healthcare organizations and defenses against phishing, business email compromise, and vishing.
MITRE ATT&CK
T1114.003 · Email Forwarding RuleIn the described incident, attackers created inbox rules that redirected senders to bank domains.T1566.001 · Spearphishing AttachmentThreat actors send email attachments posing as patient forms that deploy malware when opened.T1566.002 · Spearphishing LinkPhishing messages may urge recipients to click malicious links to provide credentials or run a payload.T1566.004 · Spearphishing VoiceAttackers call healthcare IT help desks while impersonating employees to request device enrollment.
Vendors
HuntressHuntress MDR for Microsoft 365 secures your Microsoft 365 users, applications, and environment by leveraging our 24/7 Huntress Security Operations Center (SOC).MicrosoftAccording to our 2024 Cyber Threat Report, our internal threat analysis reveals that nearly 35% of Microsoft 365 threats in healthcare involve malicious inbox rules.
Products
Huntress Managed SATRead more about Think Like a Hacker: The Threat Simulator From Huntress Managed SATHuntress MDR for Microsoft 365Huntress MDR for Microsoft 365 secures your Microsoft 365 users, applications, and environment by leveraging our 24/7 Huntress Security Operations Center (SOC).Microsoft 365 Apps for EnterpriseAccording to our 2024 Cyber Threat Report, our internal threat analysis reveals that nearly 35% of Microsoft 365 threats in healthcare involve malicious inbox rules.