Hospital IT help desks targeted by sophisticated social engineering schemes

The AHA has been made aware of a validated IT help desk social engineering scheme that uses the stolen identity of revenue cycle employees or employees in other sensitive financial roles. The scheme involves what is presumably a foreign-based threat actor calling IT help desks and leveraging stolen personally identifiable information of employees to answer security questions posed by the IT help desk. The threat actor then requests a password reset and requests to enroll a new device, such as a cell phone, to receive multi-factor authentication codes. This new device will often have a local area code. This effectively defeats multi-factor authentication, including SMS text and higher level “phishing-resistant” MFA, to provide full access to the compromised employee’s email account and other applications. The threat actor has reportedly used the compromised employee’s email account to change payment instructions with payment processors and divert legitimate payments to fraudulent U.S. bank accounts. As with other payment diversion schemes, it is believed the funds are ultimately transferred overseas…