Threat actors have been using phishing schemes to steal login credentials and divert automated clearinghouse payments, HHS and the FBI warned in a joint cybersecurity advisory.
HealthTech Security’s Post
More Relevant Posts
-
Great report from Google Cloud's Mandiant threat intelligence team. One of easiest and cost efficient ways CISOs and their teams can be proactive in guarding against social engineering attacks is to remove employee PII from data broker websites. These sites make crafting up a social engineering attack as simple as a Google search. It's a win win that benefits both the company and the employee personally. #socialengineering #cybersecurity #ciso
Recent findings from Google Cloud's Mandiant threat intelligence team have spotlighted the activities of UNC3944, a sophisticated threat group leveraging personal data for social engineering attacks and physical threats. “Mandiant noted the threat actors spoke with clear English and targeted accounts with high privilege potential. Additionally, it has been noted that they already possessed the personally identifiable information (PII) of [their] victims to bypass help desk administrators' user identity verification. Mandiant observed use of verification information, such as the last four digits of Social Security numbers, dates of birth, and manager names and job titles with associated co-workers. The level of sophistication in these social engineering attacks is evident in both the extensive research performed on potential victims and the high success rate in said attacks.” “UNC3944 operators employed consistent social engineering tactics across various victims, often calling service desks to claim they were receiving a new phone, warranting a multi-factor authentication (MFA) reset. By interacting with service desk administrators, UNC3944 could not only reset passwords for privileged accounts but also bypass associated MFA protections. The social engineering techniques went beyond the call centers as extensive SMS phishing campaigns were also observed.” “Evidence also suggests UNC3944 has occasionally resorted to fearmongering tactics to gain access to victim credentials. These tactics include threats of doxxing personal information, physical harm to victims and their families, and the distribution of compromising material.” Since the attackers are conducting extensive reconnaissance on their targets and using personally identifiable information (PII) to bypass security protocols like user verification at help desks, conduct MFA reset scams, and make threats, organizations looking to proactively mitigate their risk of being targeted should reduce the availability of their employees’ exposed personal data. Removing this data from brokers and people search sites limits the ease with which threat actors can access and exploit this information in these kinds of attacks. https://lnkd.in/dSYQiCMA #socialengineering #PII #personaldataremoval
To view or add a comment, sign in
-
-
Recent findings from Google Cloud's Mandiant threat intelligence team have spotlighted the activities of UNC3944, a sophisticated threat group leveraging personal data for social engineering attacks and physical threats. “Mandiant noted the threat actors spoke with clear English and targeted accounts with high privilege potential. Additionally, it has been noted that they already possessed the personally identifiable information (PII) of [their] victims to bypass help desk administrators' user identity verification. Mandiant observed use of verification information, such as the last four digits of Social Security numbers, dates of birth, and manager names and job titles with associated co-workers. The level of sophistication in these social engineering attacks is evident in both the extensive research performed on potential victims and the high success rate in said attacks.” “UNC3944 operators employed consistent social engineering tactics across various victims, often calling service desks to claim they were receiving a new phone, warranting a multi-factor authentication (MFA) reset. By interacting with service desk administrators, UNC3944 could not only reset passwords for privileged accounts but also bypass associated MFA protections. The social engineering techniques went beyond the call centers as extensive SMS phishing campaigns were also observed.” “Evidence also suggests UNC3944 has occasionally resorted to fearmongering tactics to gain access to victim credentials. These tactics include threats of doxxing personal information, physical harm to victims and their families, and the distribution of compromising material.” Since the attackers are conducting extensive reconnaissance on their targets and using personally identifiable information (PII) to bypass security protocols like user verification at help desks, conduct MFA reset scams, and make threats, organizations looking to proactively mitigate their risk of being targeted should reduce the availability of their employees’ exposed personal data. Removing this data from brokers and people search sites limits the ease with which threat actors can access and exploit this information in these kinds of attacks. https://lnkd.in/dSYQiCMA #socialengineering #PII #personaldataremoval
To view or add a comment, sign in
-
-
KnowBe4 Avoids Data Breach After Hiring North Korean Hacker https://ift.tt/dzhDXxp American cybersecurity firm KnowBe4 recently discovered that a new hire, brought on as a Principal Software Engineer, was actually a North Korean state actor. This individual attempted to install data-stealing malware on the company's devices, but the threat was identified and neutralised before any data breach occurred. This incident is the testament to the persistent threat from North Korean operatives posing as IT professionals, a danger that the FBI has been warning about since 2023. North Korea has a well-organised network of IT workers who disguise their true identities to secure employment with American companies. The revenue generated by these infiltrators funds the country's weapons programs, cyber operations, and intelligence gathering. How the Hacker Bypassed Checks Before hiring the malicious actor, KnowBe4 conducted extensive background checks, verified references, and held four video interviews. Despite these precautions, the individual used a stolen U.S. identity and AI tools to create a fake profile picture that matched during the video calls. This deception enabled the hacker to bypass the initial vetting process. On July 15, 2024, KnowBe4's Endpoint Detection and Response (EDR) system flagged an attempt to load malware from the Mac workstation recently issued to the new hire. The malware, designed to steal information stored in web browsers, was intended to capture any leftover credentials or data from the computer's previous user. When confronted by KnowBe4's IT staff, the state actor initially offered excuses but soon ceased all communication. Deceptive Hiring Practices KnowBe4 CEO Stu Sjouwerman explained that the scheme involved tricking the company into sending the workstation to an "IT mule laptop farm" near the address provided by the fraudster. The hacker then used a VPN to connect to the device during U.S. working hours, making it seem like they were working as usual. To prevent similar incidents, KnowBe4 advises companies to use isolated sandboxes for new hires, keeping them away from critical network areas. Additionally, firms should ensure that new employees' external devices are not used remotely and treat any inconsistencies in shipping addresses as potential red flags. This incident at KnowBe4 zeroes in on the intricate methods employed by North Korean hackers to infiltrate American companies. By staying vigilant and implementing robust security measures, firms can protect themselves from such threats. Cyber via CySecurity News - Latest Information Security and Hacking Incidents https://ift.tt/HWGVctj July 28, 2024 at 02:14PM
To view or add a comment, sign in
-
The targeting of healthcare IT help desk employees in payment-hijacking attacks is a stark reminder of the fine-grained approaches cybercriminals are employing within the cloud threat landscape. These attacks aim to circumvent traditional cybersecurity measures by exploiting human factors. - Train help desk employees on recognizing signs of social engineering and phishing attempts, namely the latest payment-hijacking tactics. - Implement stringent authentication processes for any changes to payment details or sensitive information handling. - Utilize monitoring and alerting systems that flag unusual requests or behavior patterns associated with financial processes. #HealthcareCybersecurity #SocialEngineering #PaymentHijacking #CloudThreats #CyberAwarenessTraining
Healthcare IT Help Desk Employees Targeted in Payment-Hijacking Attacks
securityweek.com
To view or add a comment, sign in
-
"These threat actors are considered experts in social engineering and use multiple social engineering techniques, especially phishing, push bombing, and subscriber identity module SIM swap attacks, to obtain credentials, install remote access tools, and or or bypass multi-factor authentication MFA." https://lnkd.in/gxGxdzgb #cybersecurity #threats #attacks #socialengineering #scatteredspider #industrialcyber #icssecurity #ics
FBI, CISA warn of Scattered Spider hackers targeting commercial facilities, adopt social engineering techniques - Industrial Cyber
industrialcyber.co
To view or add a comment, sign in
-
"These threat actors are considered experts in social engineering and use multiple social engineering techniques, especially phishing, push bombing, and subscriber identity module SIM swap attacks, to obtain credentials, install remote access tools, and or or bypass multi-factor authentication MFA." https://lnkd.in/eU7niFtH #cybersecurity #threats #attacks #socialengineering #scatteredspider #industrialcyber #icssecurity #ics
FBI, CISA warn of Scattered Spider hackers targeting commercial facilities, adopt social engineering techniques - Industrial Cyber
industrialcyber.co
To view or add a comment, sign in
-
A recent FBI and HSS advisory warns of a #SocialEngineering campaign that targets healthcare organizations and aims to divert automated clearinghouse (ACH) payments. In many cases, adversaries connect with IT help desks and impersonate employees to gain system access, Jill McKeon reports in HealthTech Security. It’s a prime example of the power of regular employee #phishing training. In cases like these, humans across your organization are your first line of defense. https://gag.gl/xwTjp4
HHS, FBI warn healthcare sector of social engineering scheme | Tech...
techtarget.com
To view or add a comment, sign in
-
I have helped people improve productivity with technology for over three decades. I'll be able to help you too.
A recent FBI and HSS advisory warns of a #SocialEngineering campaign that targets healthcare organizations and aims to divert automated clearinghouse (ACH) payments. In many cases, adversaries connect with IT help desks and impersonate employees to gain system access, Jill McKeon reports in HealthTech Security. It’s a prime example of the power of regular employee #phishing training. In cases like these, humans across your organization are your first line of defense. https://gag.gl/yMt0z3
HHS, FBI warn healthcare sector of social engineering scheme | Tech...
techtarget.com
To view or add a comment, sign in
-
A recent FBI and HSS advisory warns of a #SocialEngineering campaign that targets healthcare organizations and aims to divert automated clearinghouse (ACH) payments. In many cases, adversaries connect with IT help desks and impersonate employees to gain system access, Jill McKeon reports in HealthTech Security. It’s a prime example of the power of regular employee #phishing training. In cases like these, humans across your organization are your first line of defense. https://gag.gl/fQhe30
HHS, FBI warn healthcare sector of social engineering scheme | Tech...
techtarget.com
To view or add a comment, sign in
-
CEO @ Young Security, Inc. | ITIL | A+ | Zero Trust | GRC | IT Infrastructure | Cybersecurity & Info Assurance | DevSecOps | Email Security | Phishing & Ransomware Protection | Security Awareness Training
A recent FBI and HSS advisory warns of a #SocialEngineering campaign that targets healthcare organizations and aims to divert automated clearinghouse (ACH) payments. In many cases, adversaries connect with IT help desks and impersonate employees to gain system access, Jill McKeon reports in HealthTech Security. It’s a prime example of the power of regular employee #phishing training. In cases like these, humans across your organization are your first line of defense. https://gag.gl/pfVrYT
HHS, FBI warn healthcare sector of social engineering scheme | Tech...
techtarget.com
To view or add a comment, sign in