The help desk is now your softest identity check, and Mandiant shows how cheaply it breaks

Mandiant has published a technical analysis of voice-based social engineering, written by Nick Guttilla, that treats the remote IT support channel as the attack surface rather than a footnote ^[1]. It matters because two separate financially motivated actors, with different end goals, both walk in through the same door ^[1].

The setup is structural, not accidental. The report argues that in-person interaction has diminished and that remote IT structures such as an outsourced service desk have normalized employees dealing with external or less familiar personnel, which expands the attack surface ^[2]. Mandiant says financially motivated actors have increasingly adopted vishing as a primary vector for initial access ^[3], and that the tactic works because it preys on trust and the desire to be helpful ^[13].

The two case studies diverge after entry. The cluster tracked as UNC3944, which overlaps with Scattered Spider, calls corporate service desks and impersonates employees to have credentials and multi-factor authentication methods reset ^[4]. That access is then used for SIM swapping, ransomware deployment, and data theft extortion ^[5]. UNC6040 runs a narrower play: its operators also impersonate IT support, but the objective is to get an employee to Salesforce's connected app page and authorize a malicious, actor-controlled version of the Data Loader application ^[6]. That single authorization enables large-scale exfiltration from the victim's Salesforce environment, followed by extortion ^[7]. Mandiant frames the difference as account takeover for broad network access versus targeted theft of CRM data ^[8].

The part that should concern operators is Mandiant's own red team record. Using these techniques against clients of varying sizes, the firm reports achieving administrative-level user impersonation, corporate network perimeter breaches, and sensitive data access ^[9], and says it has convinced multiple service desks to reset credentials and alter several forms of MFA ^[10]. A technique that reproduces across organizations of different sizes is not one badly run vendor; it is a defect in how identity is verified on a phone call ^[2].

No product purchase closes this. Mandiant's reconnaissance section notes that the volume of information an attacker can gather about culture, employees, policies, procedures, and technology directly shapes how mature a scenario can be made ^[12], and the listed inputs include network ranges and IP space, domains and subdomains, cloud and email infrastructure, internet-accessible and internal web applications, code repositories, and corporate phone number and email address formats ^[11]. Most of that cannot be un-published. The only durable control sits at the moment a caller asks for something.

Three checks are available without a budget cycle. First, whether the outsourced desk's contract and runbook specify what proof is required before a credential or MFA reset, given that Mandiant obtained both by phone ^[10]. Second, whether an MFA method can be changed at all on a single inbound voice call, which is the specific step UNC3944 asks for ^[4]. Third, whether an ordinary Salesforce user can authorize a connected app, because UNC6040's entire campaign depends on that permission existing ^[3]. Each is a policy decision an executive can make this quarter, and each is testable by calling your own service desk and seeing what it gives up.