Clover Health Social Engineering Incident: Defending Against Human-Centered Breaches

Introduction

Clover Health Investments recently filed a notice with the U.S. Securities and Exchange Commission (SEC) regarding a cybersecurity incident identified in July. The breach was attributed to a social engineering attack, a vector that remains notoriously difficult to block via technical controls alone. For a healthcare entity managing vast amounts of Protected Health Information (PHI), the implications of a successful social engineering campaign are severe, potentially leading to regulatory penalties under HIPAA and significant patient trust erosion. Defenders must move beyond awareness and implement technical controls that detect the post-exploitation behaviors typical of these attacks.

Technical Analysis

Affected Systems & Scope

While the investigation is ongoing, social engineering incidents in the healthcare sector typically target:

• Cloud Productivity Suites: Microsoft 365 or Google Workspace environments to access email and patient records.
• Remote Access Infrastructure: VPNs and Remote Desktop Protocol (RDP) gateways, often accessed via compromised credentials.

Attack Mechanics (Defender Perspective)

Social engineering bypasses perimeter defenses by exploiting the "human vulnerability." The attack chain generally follows this progression:

1. Initial Contact: The adversary engages the target via vishing (voice phishing), smishing (SMS phishing), or sophisticated Business Email Compromise (BEC). In 2026, we observe attackers leveraging deep-fake audio or context-aware information scraped from public breaches to increase success rates.
2. Credential Harvesting / MFA Bypass: Unlike legacy brute-force attacks, these attacks manipulate the user into providing a one-time MFA code, approving a push notification (MFA fatigue), or resetting a password via a captured token.
3. System Access: Once authenticated, the actor gains access to email gateways or Electronic Health Records (EHR).
4. Data Exfiltration: Data is staged and exfiltrated using authorized channels (e.g., SMTP, WebDAV) to blend in with normal traffic.

Exploitation Status

This is an actively exploited human-vector threat. There is no CVE to patch; the vulnerability lies in the user's decision-making process and the organization's identity validation controls.

Detection & Response

Social engineering is silent until the point of access. Therefore, detection must focus on the anomalies that occur immediately after the user is compromised, such as the installation of remote management tools or irregular authentication patterns.

SIGMA Rules

Detects the installation of common remote management tools often used by adversaries to maintain persistence after socially engineering a victim to grant them access.

---
title: Potential Remote Access Tool Installation Post-Social Engineering
id: 8a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects installation of remote administration tools frequently utilized during tech support scams or social engineering follow-up.
references:
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/07/22
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\anydesk.exe'
      - '\teamviewer.exe'
      - '\splashtop.exe'
      - '\supremo.exe'
      - '\connectwise.exe'
      - '\logmein.exe'
  filter_legit:
    ParentImage|contains:
      - '\Program Files\'
      - '\Program Files (x86)\'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate IT support activity (verify with user)
level: high
---
title: PowerShell Base64 Encoded Command with Suspicious Keywords
description: Detects PowerShell execution often used in scripts provided by attackers during social engineering interactions.
status: experimental
data:
  type: string
  strings:
    - 'FromBase64String'
    - 'IEX'
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains|all:
      - 'powershell'
      - 'FromBase64String'
  condition: selection
falsepositives:
  - Administrative scripting
level: medium

KQL (Microsoft Sentinel)

This query targets MFA Fatigue attacks—a common technique in social engineering where an adversary spams push notifications until the user approves access.

SigninLogs
| where ResultType == 0 // Success
| where AuthenticationDetails has "MFA"
| summarize PushCount = count() by UserPrincipalName, AppId, bin(TimeGenerated, 5m)
| where PushCount > 5 // Threshold for fatigue
| join kind=inner (
    SigninLogs
    | where ResultType != 0 // Failures
    | summarize FailureCount = count() by UserPrincipalName, bin(TimeGenerated, 5m)
) on UserPrincipalName
| project UserPrincipalName, TimeGenerated, PushCount, FailureCount, AppId
| order by TimeGenerated desc

Velociraptor VQL

Hunt for persistent remote access tools that may have been installed on the endpoint.

-- Hunt for remote management tools commonly used in social engineering support scams
SELECT 
    OSPath, 
    Mtime, 
    Atime, 
    Size, 
    SHA256
FROM glob(globs="\\ProgramData\\**\\AnyDesk*.exe")

-- Hunt for TeamViewer installations
SELECT 
    OSPath, 
    Mtime, 
    Size, 
    SHA256
FROM glob(globs="C:\\Users\\*\\AppData\\Roaming\\TeamViewer\\*.exe")

Remediation Script

Run this PowerShell script on critical workstations to audit for the presence of unauthorized remote support tools.

# Audit for common remote support tools installed post-social engineering
$Tools = @("AnyDesk", "TeamViewer", "Splashtop", "Supremo", "ConnectWise", "LogMeIn")
$Found = @()

foreach ($Tool in $Tools) {
    # Check Common Installation Paths
    $Paths = @(
        "C:\Program Files\$Tool*",
        "C:\Program Files (x86)\$Tool*",
        "C:\Users\*\AppData\Roaming\$Tool*",
        "C:\Users\*\AppData\Local\$Tool*"
    )
    
    foreach ($Path in $Paths) {
        if (Test-Path $Path) {
            $Items = Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, LastWriteTime
            if ($Items) {
                foreach ($Item in $Items) {
                    $Found += [PSCustomObject]@{
                        Tool = $Tool
                        Path = $Item.FullName
                        LastWriteTime = $Item.LastWriteTime
                        Status = "Review Required"
                    }
                }
            }
        }
    }
}

if ($Found.Count -eq 0) {
    Write-Host "Audit complete. No common remote tools detected." -ForegroundColor Green
} else {
    Write-Host "WARNING: Potential remote tools found." -ForegroundColor Red
    $Found | Format-Table -AutoSize
}

Remediation

1. Immediate User Verification: If specific users were targeted in the Clover Health incident, force a password reset and revoke all active sessions for those accounts immediately.
2. Enforce Number Matching in MFA: Ensure your MFA solution (Microsoft Entra ID, Duo, etc.) requires number matching for push notifications. This effectively neutralizes MFA fatigue attacks where users blindly approve prompts.
3. Conditional Access Policies: Implement "Impossible Travel" and risky sign-in detection policies. Block access from unfamiliar geolocations or unmanaged devices for high-privilege roles.
4. Application Restrictions: Restrict the usage of consumer-grade remote support tools (AnyDesk, TeamViewer) via Application Control (AppLocker) or allow-listing policies.
5. Post-Incident Forensics: If the breach is confirmed, perform a thorough forensic analysis of mailboxes for forwarding rules (often used for data exfiltration in BEC) and audit logs for massive data exports.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub