Anatomy of an Over-the-Air Attack

On the 16th of May 2021, a new client within the UK Health Care sector contacted Hedgehog Security following the IT department’s certainty that an intrusion had occurred. The client was 100% certain that there had been an intrusion. The only missing part to the puzzle was that their SIEM had little to no alerts.

During the discovery process, it was apparent that the client had been subjected to a successful “Over the Air” attack. There were no signs of intrusion from any perimeter technology nor any indicators of data exfiltration to an external location. The intruders appeared inside the network and accessed internal systems, aggregated data to a file store, and vanished.