ShinyHunters Escalates Attacks on Healthcare Sector Via Vishing and SSO Compromise
Health-ISAC issues a warning about the increasing threat of ShinyHunters targeting healthcare organizations through sophisticated vishing and single sign-on (SSO) exploitation.
The healthcare sector is facing a heightened threat from the ShinyHunters extortion gang, which has been observed escalating its attacks to steal sensitive patient data and intellectual property. Health-ISAC, a critical information-sharing body for the health sector, has alerted healthcare and medical technology organizations to a rise in successful breaches attributed to this threat actor.
ShinyHunters has gained notoriety over the past two years for its proficiency in supply chain and identity-based attacks. The group specializes in compromising cloud Software-as-a-Service (SaaS) and storage platforms, often by targeting third-party integration partners. This tactic grants them access to valuable OAuth tokens, which are then leveraged to infiltrate major SaaS providers such as Salesforce and Snowflake.
A primary modus operandi for ShinyHunters involves identity attacks, where threat actors employ social engineering tactics, including vishing (voice phishing) and traditional phishing, to compromise corporate single-sign-on (SSO) accounts. Once an SSO account, such as those managed by Okta, Microsoft Entra, or Google, is breached, attackers gain a centralized gateway to a vast array of integrated SaaS applications. These commonly include platforms like Microsoft 365, SharePoint, DocuSign, Slack, Atlassian, Dropbox, and Google Drive, among others.
For attackers focused on data theft and extortion, a compromised SSO dashboard serves as a powerful springboard. From this central point, they can access and exfiltrate data from multiple cloud services simultaneously, significantly amplifying their potential impact and leverage. Health-ISAC emphasizes that "SSO is the control plane, and ShinyHunters' leverage is created through data theft at cloud scale."
The attack chain typically begins with vishing calls designed to manipulate employees or helpdesk personnel. Attackers aim to trick staff into performing actions such as resetting passwords, altering multi-factor authentication (MFA) methods, or enrolling new devices. These vishing kits are often custom-built for live, interactive social engineering, allowing attackers to dynamically adjust their approach and display convincing authentication dialogs in real-time during the call.
Following a successful SSO account compromise, ShinyHunters rapidly accesses connected SaaS platforms to exfiltrate data for extortion purposes. While Health-ISAC's advisory does not specify the number of incidents or affected organizations, BleepingComputer is aware of recent attacks impacting companies like Medtronic, DentaQuest, iRhythm, and OneMedical. In reported incidents, ShinyHunters has claimed to compromise Microsoft Entra SSO accounts and steal data from Microsoft 365 and SharePoint, though not all claims have been independently verified.
Health-ISAC strongly advises healthcare organizations to fortify their helpdesk and SSO security by implementing robust defenses against this attack pattern. Key recommendations include requiring out-of-band identity verification for all sensitive reset requests (password, MFA, device enrollment), employing a "no same-call" policy for helpdesk personnel, and mandating manager approval for privileged account changes. Prioritizing phishing-resistant MFA, such as FIDO2 security keys, for high-risk users and treating SSO systems as critical "Tier 0" assets are also crucial steps.
To detect and mitigate these threats, organizations should centralize identity and SaaS audit logs, monitoring for indicators like new MFA registrations, suspicious OAuth grants, unusual API activity, and bulk file downloads. Prompt incident response capabilities, including the ability to quickly revoke sessions, reset credentials, and disable malicious OAuth applications, are essential for containing breaches and minimizing data loss.