Hi there. This monday they notified me of a suspicious call one of the
secretaries got at the clinic.

Long story short: some guy with Mexican accent phoned in in order to tell the
secretary to tell one of the Doctors that he had sent him some documentation to
him via parcel delivery with certain tracking number. He also told us it was
related to a patient with a certain insurance policy with a certain insurance
company. So far, so good (we deal with lots of foreigner patients and we often
get documents shipped from somewhere else).

Then, the guy said: "By the way, it seems Dr. Ubaldo cancelled an appointment we
had with him. Can you phone him to check?"

Mind you, "Dr. Ubaldo" is an external agent the clinic works with sometimes, but
it is not part of the staff. So the secretary told him "We don't have his
number."

Then Mr. Mexican gave her a phone number with a Mexican international prefix. At
that point the secretary was a bit suspicious. She noted it down and told Mr.
Mexican she would check later (she later said her idea was asking the boss if he
knew what the fuck all that was about before phoning anywhere).

Mr. Mexican said "It'd be better if you called now."

"I can't call from this call center" (lie)

"Don't you have a mobile phone or something?"

"Yes, but I am not going to use my personal cell phone for an international job
call."

And then Mr. Mexican hung up.

So research afterwards reveals the patient and the insurance policy does not
exist and the whole thing seems to have just been a trick to lure the secretary
into phoning that particular phone number.

Does anybody have the slightiest idea of what the goal was? My theory is that it
was a recognizansse job to harvest data for future attacks.



--
gopher://gopher.richardfalken.com/1/richardfalken
--- SBBSecho 3.20-Linux
 * Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)