Health Care Social Engineering Campaign

ReliaQuest investigated a targeted early-April 2024 campaign against healthcare Revenue Cycle Management staff in which attackers used prior-breached credentials and location-spoofed infrastructure to access VPNs, then social-engineered help-desk personnel to reset MFA and take over accounts; compromised mailboxes and SharePoint were searched for banking information and likely used to alter routing details. The report provides observed IOCs, discusses attacker infrastructure and techniques, and offers defensive recommendations (stricter help-desk verification, device-based auth, conditional access).