SCATTERED SPIDER Uses Social Engineering and SIM Swaps to Target Organizations
Summary
A DarkOwl overview describes SCATTERED SPIDER’s reported phishing, helpdesk impersonation, SIM swapping and credential theft, along with its tools, malware and high-profile targets. It recommends training helpdesk staff on vishing, smishing and OTP attacks.
Key points
- CISA reporting says the group uses phishing, push bombing and SIM swaps to obtain credentials, install remote-access tools and bypass MFA.
- Attackers have reportedly impersonated IT or helpdesk staff to persuade employees to share credentials, run remote-access tools or provide one-time passwords.
- The article says the group uses legitimate administration and remote-access tools, as well as infostealers and remote-access malware.
- Reported targets include technology, telecommunications, business-process outsourcing and critical-infrastructure organizations.
- The article associates the group with attacks on Twilio and MGM; it describes MGM attribution to SCATTERED SPIDER as widely reported and cites allegations about the attack method.
- DarkOwl recommends training helpdesk staff on vishing, smishing and OTP-based attacks, which it says may receive less attention than phishing-email risks.
Article Details
- Topic
- Profile of SCATTERED SPIDER, including its social-engineering tactics, tools, malware, and reported cyberattacks.
MITRE ATT&CK
T1059.001 · PowerShellThe group reportedly uses PowerShell for reconnaissance.T1078 · Valid AccountsThe group reportedly uses stolen credentials to access accounts and conduct account takeovers.T1566 · PhishingThe group is reported to use phishing attacks, including phishing associated with target organizations.T1566.004 · Spearphishing VoiceThe group reportedly impersonated an employee in a phone call to MGM's helpdesk.T1621 · Multi-Factor Authentication Request GenerationThe group reportedly uses push bombing to obtain MFA approval.
Threat Actors
ALPHVRansomware group described as BlackCat/ALPHV; SCATTERED SPIDER is reported to have acted as an affiliate.BlackCatRansomware group described as BlackCat/ALPHV; SCATTERED SPIDER is reported to have acted as an affiliate.Scattered SpiderCybercriminal group reported to target companies and their supply chains, steal data for extortion, and use social engineering.
Malware
Raccoon StealerRaccoon Stealer Steals information including login credentials, browser history, cookies, and other data.VidarVIDAR Stealer Steals information including login credentials, browser history, cookies, and other data.WarzoneAveMaria (also known as WarZone) Enables remote access to a victim’s systems.
Products
Tools
Fleetdeck.ioFleetdeck.io Enables remote monitoring and management of systems.Level.ioLevel.io Enables remote monitoring and management of systems.MimikatzMimikatz Extracts credentials from a system.NgrokNgrok Enables remote access to a local web server by tunneling over the internet.PowerShellResearchers report that the group have adopted tools such as PowerShell to conduct reconnaissance as well as exploiting identity providers and modifying security systems to conduct their malicious activities.PulsewayPulseway Enables remote monitoring and management of systems.ScreenConnectScreenconnect Enables remote connections to network devices for management.SplashtopSplashtop Enables remote connections to network devices for management.Tactical RMMTactical.RMM Enables remote monitoring and management of systems.TailscaleTailscale Provides virtual private networks (VPNs) to secure network communications.
Industries
business process outsourcingAccording to MITRE, when they emerged in 2022 they targeted customer relationship management and business process outsourcing firms as well as telecommunications and technology companies.Critical infrastructureRecent activity has shown them targeting other sectors including critical infrastructure organizations.TechnologyAccording to MITRE, when they emerged in 2022 they targeted customer relationship management and business process outsourcing firms as well as telecommunications and technology companies.TelecommunicationsAccording to MITRE, when they emerged in 2022 they targeted customer relationship management and business process outsourcing firms as well as telecommunications and technology companies.