Threat Intelligence Brief
Curated summary with source attribution
Source: rescana.com
Threat Risk: High
Victim: Abbott Laboratories
Incident: Simultaneous breaches of legacy diagnostic systems and a customer portal via vishing and credential theft.
Impact: Exfiltration of sensitive PII, internal contracts, and technical regulatory documentation.
Attacker: ShinyHunters and ShadowByt3$
Analysis: The first breach involved a vishing campaign by ShinyHunters to hijack a Microsoft Entra SSO account, enabling lateral movement across numerous SaaS platforms including Salesforce and Microsoft 365. In a separate event, the actor ShadowByt3$ allegedly exploited API endpoints and compromised credentials to access the LabCentral customer portal. These incidents underscore the critical risk of identity-based attacks and the vulnerabilities inherent in legacy system integrations.
Recommendations: Deploy phishing-resistant MFA, such as FIDO2, to thwart vishing and session hijacking attempts.; Audit legacy system access and strictly limit SaaS integration permissions to reduce the blast radius of a compromised account.; Implement robust API security controls, including rate limiting and enhanced authentication, for all external-facing portals.
Source: Rescana
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source