Cybercrime Group “Scattered Spider” is a Social Engineering Threat

The US Cybersecurity and Infrastructure Security Agency (CISA) and the FBI have released a joint Cybersecurity Advisory describing the Scattered Spider cybercriminal gang’s activities. The group, believed to be unusual both for the relative youth of its members and their native proficiency in English, was responsible for this summer’s compromises of MGM Resorts and Caesars Entertainment. It also excels at social engineering.

“Scattered Spider (also known as Starfraud, UNC3944, Scatter Swine, and Muddled Libra) engages in data extortion and several other criminal activities,” the joint advisory said. “Scattered Spider threat actors are considered experts in social engineering and use multiple social engineering techniques, especially phishing, push bombing, and subscriber identity module (SIM) swap attacks, to obtain credentials, install remote access tools, and/or bypass multi-factor authentication (MFA).” The threat actor targets large companies, and has “been known to utilize BlackCat/ALPHV ransomware alongside their usual TTPs.”

The joint advisory represents a call for information sharing as much as it does a warning against the activities of this particular threat group. Scattered Spider has taken an unusual interest in its victims' internal corporate communication channels like Slack, Microsoft Teams, and Microsoft Exchange. Their social engineering is an ongoing effort, and not merely a way of obtaining initial access to their targets. They look for signs their victims have detected Scattered Spider intrusions, and they’ve been caught trying to join conversations about remediation efforts.

The FBI has for several months known the identities of about a dozen members of Scattered Spider, and some observers have wondered why the Bureau hasn't been more aggressive in making arrests. “If you look at some of the things that we've been doing over the last year, from Hive, to Genesis Market, to BreachForums and the arrest that we had, then to Quakbot, just because you don't see actions being taken, it doesn't mean that there aren't actions that are being taken,” the senior FBI officials said during a media availability. “So there's a lot of things that we do behind the scenes.”

New-school security awareness training can give your organization an essential layer of defense against social engineering attacks.

The Record has the complete story here.