Hackers related to “Scattered Spider” techniques have expanded their concentrating on to the aviation and transportation industries after beforehand attacking insurance coverage and retail sectors
These menace actors have employed a sector-by-sector method, initially concentrating on retail firms, reminiscent of M&S and Co-op, in the UK and the United States and subsequently shifting their focus to insurance coverage firms.
Whereas the menace actors weren’t formally named as liable for insurance coverage sector assaults at first, current incidents have impacted Aflac, Erie Insurance coverage, and Philadelphia Insurance coverage Firms.
Hackers goal the aviation trade
On June 12, Canada’s second-largest airline, WestJet, suffered a cyberattack that briefly disrupted the corporate’s inside providers and cellular app.
Quickly after the breach, sources informed BleepingComputer that Palo Alto Networks and Microsoft have been aiding within the response to the assault.
The assault was attributed to Scattered Spider, who allegedly compromised the corporate’s information facilities and its Microsoft Cloud surroundings.
BleepingComputer was knowledgeable that the menace actor gained entry by performing a self-service password reset for an worker, which enabled them to register their very own MFA and procure distant entry to the community via Citrix.
Whereas different menace actors conduct identification assaults, Scattered Spider has turn into related to this tactic attributable to their common concentrating on of assist desks and password and MFA infrastructure.
Right this moment, Hawaiian Airways additionally disclosed that they suffered a cyberattack however didn’t present any particulars that might point out who was behind the assault. Nevertheless, a supply informed BleepingComputer that it’s believed that the identical menace actors are accountable.
Palo Alto Networks’ Sam Rubin, SVP of Consulting and Menace Intelligence, has now confirmed on LinkedIn that Scattered Spider has begun concentrating on the aviation trade.
“Unit 42 has noticed Muddled Libra (often known as Scattered Spider) concentrating on the aviation trade,” warned Rubin.
“Organizations needs to be on excessive alert for classy and focused social engineering assaults and suspicious MFA reset requests.”
Mandiant’s Charles Carmakal additionally warned that the menace actors have now switched their focus to each the aviation and transportation sectors.
“ALERT: Scattered Spider has added North American airline and transportation organizations to their goal listing,” Carmakal posted to LinkedIn.
“Mandiant (a part of Google Cloud) is conscious of a number of incidents within the airline and transportation sector which resemble the operations of UNC3944 or Scattered Spider.
“We suggest that the trade instantly take steps to tighten up their assist desk identification verification processes previous to including new cellphone numbers to worker/contractor accounts (which can be utilized by the menace actor to carry out self-service password resets), reset passwords, add units to MFA options, or present worker info (e.g. worker IDs) that may very well be used for a subsequent social engineering assaults.”
American Airways can be at present struggling an IT outage however it’s unclear if it’s a safety incident. BleepingComputer contacted the airline however has not acquired a response.
What’s Scattered Spider
Scattered Spider, often known as 0ktapus, Starfraud, UNC3944, Scatter Swine, Octo Tempest, and Muddled Libra, is a classification of menace actors which can be adept at utilizing social engineering assaults, phishing, multi-factor authentication (MFA) bombing (focused MFA fatigue), and SIM swapping to realize preliminary community entry on massive organizations.
These menace actors embody younger English-speaking folks with various ability units who frequent the identical hacker boards, Telegram channels, and Discord servers. These mediums are then used to plan and execute assaults in actual time.
Some are believed to be a part of the “Com” – a loose-knit neighborhood of menace actors recognized for monetary fraud, cryptocurrency theft, information breaches, and extortion assaults.
Whereas Scattered Spider is usually known as a cohesive gang, it’s really used to indicate menace actors who make the most of particular techniques when conducting assaults. As assaults related to Scattered Spider techniques are additionally generally utilized by totally different people from a unfastened community of menace actors, it makes it tough to trace them.
Not like many different English-speaking menace actors, these related to “Scattered Spider” have been recognized to companion with Russian-speaking ransomware gangs, reminiscent of BlackCat, RansomHub, Qilin, and DragonForce.
Different assaults linked to Scattered Spider embody these on MGM, Marks & Spencer, Co-op, Twilio, Coinbase, DoorDash, Caesars, MailChimp, Riot Video games, and Reddit.
Organizations defending in opposition to one of these menace actor ought to begin with gaining full visibility throughout the complete infrastructure, identification methods, and significant administration providers.
This contains securing self-service password reset platforms and assist desks, widespread targets of those menace actors.
Each Google Menace Intelligence Group (GTIG) and Palo Alto Networks have launched guides on hardening defenses in opposition to the recognized “Scattered Spider” techniques utilized by these menace actors.
All admins are suggested to familiarize themselves with the following pointers and harden their identification platforms and processes.
Replace 6/27/25: Added that American Airways is at present affected by an IT outage.
Patching used to imply advanced scripts, lengthy hours, and countless fireplace drills. Not anymore.
On this new information, Tines breaks down how trendy IT orgs are leveling up with automation. Patch quicker, scale back overhead, and deal with strategic work — no advanced scripts required.
