So, I support a good sized corporate phone system.

We recently had someone (I assume external) hack a user's voicemail box and set up three notification devices, all external numbers and all with another string to dial when connected. What I don't see is what they are accomplishing with that setup. The notification devices were all calling what looks to be a Chicago number that seemed to be another Unity mailbox.

I guess I just don't think like a fraudster.

Trying to steal 2FA codes for people that use the "call me with a code" option?

More than likely setting something that's weird but plausible, monitoring if it gets detected then point into to some shady Telco for toll fraud. Are you on 15 already?

Go cloud. Premise systems are extremely vulnerable.