Attackers Rerouted Employee Pay Without Breaching IT Systems

An attacker used phone-based social engineering against payroll, HR and IT help desks to reset credentials and re-enroll MFA, enabling legitimate logins to payroll systems and silent redirection of three employees' direct deposits to attacker-controlled accounts; Unit 42 contained the fraud, remediated identities and hardening controls, and also discovered an unrelated persistent WannaCry infection in legacy OT systems.