--- title: "Bitter Pill" url: https://daily.dev/posts/bitter-pill-fej7hsdls source_url: https://www.huntress.com/blog/third-party-pharmaceutical-vendor-linked-to-pharmacy-and-health-clinic-cyberattack type: article source: "Huntress Blog" published: 2026-05-31T07:42:54.952Z updated: 2026-05-31T08:28:27.991Z tags: ["cyber"] reading_time: 8 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Bitter Pill **[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 8 min read · 0 upvotes · 0 comments ## Summary Huntress uncovered a cyberattack targeting multiple healthcare organizations — including pharmacies — through a compromised ScreenConnect instance tied to Transaction Data Systems (now Outcomes), makers of Rx30 and ComputerRx pharmacy software. Threat actors used the legitimate remote access tool for initial access, then installed additional ScreenConnect and AnyDesk instances for persistence. Post-access activity included downloading a C# Meterpreter loader via MSBuild, credential harvesting via WDigest registry modification, Active Directory enumeration, and network scanning. IOCs include four malicious IPs, file hashes, ScreenConnect instance IDs, and an open directory hosting tools including a Veeam CVE-2023-27532 exploit. Huntress urges all Transaction Data Systems/Outcomes clients to immediately check for these IOCs and recommends enhanced endpoint monitoring and proactive threat hunting. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [How a single ScreenConnect incident exposed a massive campaign](https://daily.dev/posts/how-a-single-screenconnect-incident-exposed-a-massive-campaign-hxzs54kdz) · Securelist · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber) [View this post on daily.dev](https://daily.dev/posts/bitter-pill-fej7hsdls)