The New York State Department of Financial Services (NYDFS) has recently released urgent guidance for IT and help desk personnel in light of the latest cybersecurity threats emerging in October 2024. This advisory emphasizes the need for heightened vigilance, particularly around social engineering tactics aimed at bypassing security measures through IT and help desk channels.

In this new wave of cyberattacks, threat actors are increasingly targeting IT and help desk professionals via phone calls. Their primary tactic is to request password resets or claim issues with multi-factor authentication (MFA) in attempts to gain unauthorized access to user accounts. This sophisticated attack method aims to exploit the trust placed in IT personnel, leveraging their role as gatekeepers to sensitive systems.

To mitigate these risks, NYDFS has requested that all IT and help desk staff remain on high alert and follow stringent verification processes before resetting any credentials or granting access to systems. A key element of the guidance is the reminder for organizations to train their staff on recognizing the signs of social engineering attacks. This includes revisiting established protocols for verifying the identity of individuals requesting password changes or MFA resets.

For further protective measures, NYDFS advises personnel to refer to guidance from the Cybersecurity and Infrastructure Security Agency (CISA), which offers comprehensive resources on preventing social engineering and phishing attacks. CISA’s documentation details best practices, such as requiring secondary confirmations and verifying through known channels such as a callback number, to reduce the chance of falling victim to these schemes.