Access to employees’ email accounts, and then pivoted to specifically target login information related to the processing of reimbursement payments to insurance companies, medicare, or similar entities.
To gain initial access to victim networks, the threat actor acquired credentials through social engineering or phishing. In some observed instances, the threat actor called an organization’s IT Help Desk posing as an employee of the organization, and triggered a password reset for the targeted employee’s organizational account [T1566.004]. In some instances, by manipulating the IT Help Desk employees, the threat actor was able to bypass multifactor authentication (MFA) [T1556.006]. In another instance, the threat actors registered a phishing domain [T1556.001] that varied by one character from the target organization’s true domain, and targeted the organization’s Chief Financial Officer (CFO) [TA1656].
Read more…
Source: U.S. Federal Bureau of Investigation Cyber Division
Related:
- 76 iOS Apps, Including Medical and Banking Tools, Are Exposing Data to Hackers
February 7, 2017
Seventy-six popular apps in the Apple App Store are vulnerable to silent interception of TLS-protected data due to a poor implementation of the cryptographic protocol. According to researcher Will Strafach, who wrote on Medium, the apps are vulnerable to man-in-the-middle attacks. Data that is normally protected by Transport Layer Security can now be read or manipulated ...
- Google mistakes the entire NHS for massive cyber-attacking botnet
February 1, 2017
Google is blocking access to the entire NHS network, mistaking the amount of traffic it is currently receiving as a cyber attack. An email from an NHS trust’s IT department seen by The Register confirmed that the US search giant has mistaken the current traffic levels for a botnet. The email headed “Google Access” stated: “Google is ...