In the shadowy corners of the digital world, the nefarious hacking collective, known as Scattered Spider, continues to weave a tangled web of intrigue and criminal activity. This insidious group has amassed quite a reputation for its exploits; last year, it was responsible for the notorious cyber attacks on MGM Resorts International and Caesars Entertainment.
Now, reports surface that they are allegedly extending their illicit activities to target two insurance companies alongside dozens other businesses, according to information from Bloomberg News. The same source also suggests that this group hasn’t limited its ambitions to merely these sectors, but have further set their sights on the financial services sector. Among their list of potential victims include high-profile companies such as Visa, PNC Financial Services Group, and Synchrony Financial.
Their most recent exploits were brought to light by Resilience Cyber Insurance Solutions, a cybersecurity firm that’s engaged in keeping a watchful eye on Scattered Spider’s activities. In previous encounters, the hacking group utilized fraudulent login pages to pilfer user credentials.
The challenges posed by Scattered Spider are not lost on law enforcement. FBI Deputy Assistant Director of the Cyber Division, Brett Leatherman, spoke candidly on the issue, stating, “We have to continue to evolve as they evolve. We have to innovate as they innovate”. This collective commitment to outmaneuvering Scattered Spider has necessitated a proactive response from private sector victims; reaching out to these victims to collate information and data on the illicit group’s operations is a crucial part of disrupting their activities.
Believed to be loosely connected to another group named “the Community,” Scattered Spider is purportedly linked to Russian ransomware collectives, as per Recorded Future News reports. While law enforcement has seen success in confronting similar hacking groups, such as LockBit – where authorities managed to infiltrate their website and unveil information on its members – Scattered Spider presents a unique challenge.
Leatherman, acknowledging the difficulty of the situation, affirmed the FBI’s dedication to dismantling malevolent collectives like these. “We will always endeavor to do it,” he declared. “We are putting our best folks forward on that disruption — especially in a group like Scattered Spider.”
Apart from Scattered Spider, this group has also been known to operate under other pseudonyms, including Star Fraud, UNC3944, and Octo Tempest.
Last September, Scattered Spider took a significant toll on MGM Resorts, causing a week-long outage of its internal cybersecurity and data systems. Although MGM didn’t bow to the hackers’ monetary demands, the attack nonetheless resulted in a $100 million hit to their third-quarter earnings and an additional $10 million in one-time expenses. Facing an FTC probe into the breach, this year, MGM Resorts filed a lawsuit against the Federal Trade Commission due to potential conflicts of interest involving FTC Chairwoman Lina Khan.
Meanwhile, Caesars Entertainment was not so fortunate. Following a crippling cyber attack, they were reportedly extorted for tens of millions of dollars by Scattered Spider.
As the digital landscape continues to expand, hacking collectives such as Scattered Spider pose an increasingly ominous threat, highlighting the necessity of robust cybersecurity measures for businesses across all sectors.
