Attackers abuse Microsoft 365 Groups to create phishing invitations

This episode examines three emerging cybersecurity threats affecting healthcare organizations: Microsoft 365 Groups being exploited for calendar-based phishing attacks, newly discovered vulnerabilities in the widely used DICOM Toolkit that could impact medical imaging systems, and a data breach that originated through social engineering targeting third-party applications. The hosts provide actionable guidance on tightening platform configurations, vetting vendors, and strengthening staff training to address these preventable security gaps.

Episode Transcript

SPEAKER_01 (00:00):
You're listening to Pow Box Weekly, fully automated.

SPEAKER_00 (00:03):
And we're back.
I'm Jen.
I spend my days thinking abouthow attackers think so you don't
have to.

SPEAKER_01 (00:09):
And I'm Alex, healthcare IT guy who's been in
the trenches long enough to knowthat it won't happen to us is
famous last words.
Jen, what do we have this week?

SPEAKER_00 (00:20):
Oh, we've got a good one.
Attackers are now abusingMicrosoft 365 groups to run
phishing campaigns.

SPEAKER_01 (00:27):
Wait, using Microsoft's own infrastructure?

SPEAKER_00 (00:30):
Yep.
They're sending malicious groupinvites.
And once you're in, they hit youwith what researchers are
calling Cal phishing.
A calendar invite in ICS formatlands right in your outlook.

SPEAKER_01 (00:42):
So it's not just an email you can delete and move
on.

SPEAKER_00 (00:45):
That's the thing.
Even if you delete the originalemail, the calendar event sticks
around.
It's persistent.
It's sitting there on yourcalendar like a meeting you
forgot you accepted.
That's clever and terrifying.
It's both.
For healthcare orgs, this is areminder.
Your email security is only asgood as your understanding of
how these platforms work.

(01:07):
Calendar invites?
They're a delivery mechanismnow.

SPEAKER_01 (01:10):
Practical takeaway?

SPEAKER_00 (01:12):
Review your Microsoft 365 group settings.
Limit who can create groups, whocan send invites, and train your
staff.
If they didn't schedule it, theyshouldn't click it.

SPEAKER_01 (01:23):
Alright, next up, vulnerabilities in the DICOM
toolkit.
And for anyone who doesn't livein imaging departments, DICOM is
basically the language thatmedical images speak.

SPEAKER_00 (01:35):
Right.
It's the standard for storingand transmitting everything from
X-rays to MRIs.
Radiology, cardiology,radiotherapy, all of it.
So when researchers find flawsin a widely used toolkit that
implements DICOM, you're lookingat potential exposure across
thousands of healthcareorganizations, patient data at

(01:56):
risk, imaging servicesdisrupted.
And because this is a toolkit,meaning other software builds on
top of it, you've got supplychain risk too.

SPEAKER_01 (02:05):
This feels like one of those check with your vendors
immediately situations.

SPEAKER_00 (02:10):
Exactly.
If you're running any imagingsoftware, ask your vendor.
Are you using this toolkit?
Have you patched?
Don't assume you're not affectedjust because you didn't build it
yourself.

SPEAKER_01 (02:22):
And then we have iRhythm confirming a data
breach.
They're a healthcare techcompany, cardiac monitoring,
right?

SPEAKER_00 (02:29):
That's them.
They disclose that attackers gotin through third-party business
applications, stole patientdata, proprietary info, and
then, classic move, sent aransom demand.

SPEAKER_01 (02:40):
The pay us or we publish playbook.

SPEAKER_00 (02:44):
Which we're seeing more and more.
And here's the detail that stoodout to me.
The attack used socialengineering techniques, not some
zero-day exploit, not asophisticated nation-state tool.
Someone got tricked.
Human error.
Human nature.
People want to be helpful.
Attackers know that.
For healthcare orgs, this isanother reminder.

(03:05):
Your third-party apps are partof your attack surface.
You need to know what data theytouch, and you need your people
trained to spot manipulation.

SPEAKER_01 (03:13):
So we've got Microsoft infrastructure being
weaponized, medical imagingsoftware with supply chain
vulnerabilities, and a breachthat started with social
engineering.

SPEAKER_00 (03:24):
Three different stories, same theme.
It's not bad luck.
It's bad configurations, blindspots, gaps in training.
And the frustrating part, mostof this is fixable.

SPEAKER_01 (03:36):
Calendar permissions can be tightened, vendors can be
asked hard questions, staff canbe trained to pause before
clicking.
None of it's glamorous, but itworks.
That's the work.
That's the work.
Alright, that's our show forthis week.
Thanks for spending a fewminutes with us.

SPEAKER_00 (03:54):
Stay sharp out there.
And maybe check your calendarfor meetings you didn't
schedule.

SPEAKER_01 (03:59):
Take care, everyone.