How It Really Happened: "Critical access"
Critical Access
Security Topic: Trusted Relationship Phishing
NINJIO Season 11: Episode 06
Emotional Susceptibility: URGENCY & OBEDIENCE
When a ransomware attack shuts down hospital ventilators, an ICU CHARGE NURSE — played by Connie Sellecca — and the hospital’s CISO race to keep patients alive while uncovering how attackers gained access through trusted relationship phishing (TRP). The incident shows how cybercriminals exploit compromised vendor accounts and urgent requests to trick employees into installing malicious files. Independent verification, caution with attachments, and immediate reporting are all emphasized as being critical to limiting harm.
Teachable Takeaways
- In Trusted Relationship Phishing attacks (TRP), hackers use compromised email accounts of people we know and trust to trick us into following their requests.
- Urgent requests should be verified through a second channel, such as a call-back using a trusted number.
- Report suspicious messages immediately. When it comes to limiting the scope of a cyberattack, speed beats certainty.
Additional Reading
- ‘This has pulled us together’: UMMC prioritizes care, learning during cyberattack – UMC
- Mississippi hospital system closes all clinics after ransomware attack – AP
- Expert says UMMC could face ‘weeks to months’ of recovery after cyberattack – Mississippi Today
- Spotting the spyware: How modern spies are weaponizing phishing – Tech Radar
- Microsoft warns of rising AitM phishing attacks on energy sector – IT Pro
- Business email compromise scams take new dimension with multi-stage attacks – CSO Online
- Trusted Relationship – MITRE
About NINJIO
NINJIO reduces human-based cybersecurity risk through engaging training, personalized testing, and insightful reporting. Our multi-pronged approach to training focuses on the latest attack vectors to build employee knowledge and the behavioral science behind human engineering to sharpen users’ intuition. The proprietary NINJIO Risk Algorithm™ identifies users’ social engineering vulnerabilities based on NINJIO Phish3D phishing simulation data and informs content delivery to provide a personalized experience that changes individual behavior.
