Health-ISAC warns of ShinyHunters’ increasing attacks on healthcare SSO accounts

According to Bleeping Computer, Health-ISAC is alerting healthcare and medical technology organizations to a rise in successful attacks by the ShinyHunters extortion gang, which is exploiting social engineering tactics to compromise single sign-on (SSO) accounts and steal data from cloud services.

ShinyHunters primarily targets cloud SaaS and storage platforms through supply chain and identity attacks. They have recently focused on compromising corporate SSO accounts, such as Okta, Microsoft Entra, and Google, by using social engineering methods like vishing and phishing. Once access is gained, attackers can leverage the SSO dashboard to access multiple integrated SaaS applications, including Salesforce, Microsoft 365, and others, to exfiltrate data for extortion.

Health-ISAC advises organizations to strengthen helpdesk and SSO security by implementing out-of-band identity verification for password and MFA resets, enforcing a "no same-call" policy for resets, and requiring additional verification for high-risk users. Deploying phishing-resistant MFA and restricting SMS/voice-based authentication are also recommended. Organizations should treat SSO systems as critical assets and monitor for signs of account takeover and large-scale data access. Recent attacks have impacted companies like Medtronic, DentaQuest, iRhythm, and OneMedical.

Source: Bleeping Computer