Good morning. Yesterday's news is a reminder that the loudest incidents rarely start with an exploit.
A vishing attack reached 1.4 million patient records at Central Ohio Primary Care
Central Ohio Primary Care acknowledged on October 15 that an August cyberattack exposed protected health and personal information of more than 1.4 million current and former patients and employees. The attacker started with vishing, posing as a trusted source to gain unauthorized access to files holding PHI. COPC says the vishing was not directed at patients. Several class-action law firms say the Chaos ransomware group has taken credit, a claim I am labeling UNVERIFIED until a company statement or posted samples back it up.
What to do: treat inbound voice and Teams requests that move access or credentials as hostile by default, and require call-back verification through a known number. Your helpdesk is a privileged attack surface. Rehearse this exact scenario.
Microsoft-led takedown dismantles a billion-message phishing network
Microsoft, Health-ISAC, Japan's JC3, and partners disrupted the YAM Store marketplace and three Chinese-language phishing kits, CoGUI, Haozi, and Iron Man, tracked as Storm-3119 and Storm-2990. Since January 2026 the kits supported more than one billion messages against 75,000-plus organizations in 150 countries. A federal court order backed domain seizures and redirections, with 20,000-plus accounts disabled and 100,000-plus fraud domains blocked.
What to do: hunt Entra ID sign-in logs for device-code flow abuse and audit app consent grants. Storm-3119 held admin access through app-only auth with stolen client secrets, which survives a user password reset. Expect the operators to rebuild their infrastructure.
DOJ dismantles Famous Chollima's remote IT worker fraud ring
The Department of Justice charged 14 individuals and seized about 187 computers, hitting more than 40 laptop farms in the Famous Chollima group's North Korean remote IT worker scheme. If you hire remote, vet every remote worker like a privileged account: verify identity, audit remote access logs for geographic anomalies, and geofence VPN and remote desktop.
Full entries with huntable indicators: kevintswaney.com/vuln-watch
Kevin Swaney
Principal Cybersecurity Engineer with 17+ years across banking, payments, and consulting. Writing about AI security, identity, and the fundamentals that stop most incidents. kevintswaney.com