Bitter Pill: Third-Party Pharmaceutical Vendor Linked to Pharmacy and Health Clinic Cyberattack

Huntress identified coordinated unauthorized access across multiple healthcare environments where attackers abused locally hosted ScreenConnect instances (linked to Transaction Data Systems/Outcomes) to establish persistent remote access, deploy additional RATs (AnyDesk), deliver a Meterpreter-loading C# payload (test.xml), create administrative accounts, and perform internal reconnaissance; the report includes IPs, hashes, ScreenConnect instance IDs, file paths, and recommended mitigation steps.