Cybercrime Group “Scattered Spider” is a Social Engineering Threat
The US Cybersecurity and Infrastructure Security Agency (CISA) and the FBI have released a joint Cybersecurity Advisory describing the Scattered Spider cybercriminal gang’s activities. The group, believed to be unusual both for the relative youth of its members and their native proficiency in English, was responsible for this summer’s compromises of MGM Resorts and Caesars Entertainment. It also excels at social engineering.
“Scattered Spider (also known as Starfraud, UNC3944, Scatter Swine, and Muddled Libra) engages in data extortion and several other criminal activities,” the joint advisory said. “Scattered Spider threat actors are considered experts in social engineering and use multiple social engineering techniques, especially phishing, push bombing, and subscriber identity module (SIM) swap attacks, to obtain credentials, install remote access tools, and/or bypass multi-factor authentication (MFA).” The threat actor targets large companies, and has “been known to utilize BlackCat/ALPHV ransomware alongside their usual TTPs.”
The joint advisory represents a call for information sharing as much as it does a warning against the activities of this particular threat group. Scattered Spider has taken an unusual interest in its victims’ internal corporate communication channels like Slack, Microsoft Teams, and Microsoft Exchange. Their social engineering is an ongoing effort, and not merely a way of obtaining initial access to their targets. They look for signs their victims have detected Scattered Spider intrusions, and they’ve been caught trying to join conversations about remediation efforts.
The FBI has for several months known the identities of about a dozen members of Scattered Spider, and some observers have wondered why the Bureau hasn’t been more aggressive in making arrests. “If you look at some of the things that we’ve been doing over the last year, from Hive, to Genesis Market, to BreachForums and the arrest that we had, then to Quakbot, just because you don’t see actions being taken, it doesn’t mean that there aren’t actions that are being taken,” the senior FBI officials said during a media availability. “So there’s a lot of things that we do behind the scenes.”
New-school security awareness training can give your organization an essential layer of defense against social engineering attacks. KnowBe4 enables your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
The Record has the story.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW