Scattered Spider: Difference between revisions
TomCat4680 (talk | contribs) |
→MGM hack: CE |
||
| Line 13: | Line 13: | ||
=== MGM hack === |
=== MGM hack === |
||
Scattered Spider collaborated with ALPHV, a software development team which provides [[ransomware]] as a service. Scattered Spider called MGM's [[Technical support|help desk]] posing |
Scattered Spider collaborated with ALPHV, a software development team which provides [[ransomware]] as a service. Scattered Spider called MGM's [[Technical support|help desk]] posing as an employee it found on [[LinkedIn]] to gain internal access. The group gained access on September 11, 2023.<ref name=":4" /> |
||
MGM Resorts first disclosed the cyberattack on September 12, 2023, in a regulatory filing. The company stated that though it has "dealt" with the cyberattack, many of the computer systems at its resorts remain offline, which include but are not limited to credits for food, beverages, and free credits. The attack further disabled on-site ATMs as well as remote room keys, and prevented MGM from charging patrons for parking.<ref name=":5" /> |
MGM Resorts first disclosed the cyberattack on September 12, 2023, in a regulatory filing. The company stated that though it has "dealt" with the cyberattack, many of the computer systems at its resorts remain offline, which include but are not limited to credits for food, beverages, and free credits. The attack further disabled on-site ATMs as well as remote room keys, and prevented MGM from charging patrons for parking.<ref name=":5" /> |
||
MGM and the US [[Federal Bureau of Investigation|FBI]] are presently investigating the cyberattack, and the casino operator has taken down |
MGM and the US [[Federal Bureau of Investigation|FBI]] are presently investigating the cyberattack, and the casino operator has taken down it's website.<ref name=":2" /> [[Moody's Corporation]] has stated that due to MGM's heavy reliance on computers for much of its operations, it's [[credit rating]] could go down as a result of the cyberattack.<ref name=":3" /> |
||
=== Caesars hack === |
=== Caesars hack === |
||
Revision as of 22:07, 14 September 2023
 | It has been suggested that 2023 MGM IT attack be merged into this article. (Discuss) Proposed since September 2023. |
Scattered Spider, also referred to as UNC3944 Scatter Swine and Muddled Libra,[1] is a hacking group mostly made up of individuals aged 19 to 22 as of September 2023. The group, whose name was first tagged by cybersecurity researchers, gained notoriety for hacking Caesars Entertainment and MGM Resorts International, two of the largest casino and gambling companies in the United States. Scattered Spider is predicted to be primarily made up of operatives based in both the US and the United Kingdom.[2][3]
Early history
Scattered Spider is predicted to be founded in May 2022, where its early attacks were made out on telecommunications firms. The group engaged in the SIM swap scam, Multi-factor authentication fatigue, and phishing by SMS and Telegram.[1] Their activities prior to their casino cyberattacks were noted for further exploiting the security bug CVE-2015-2291, a cybersecurity issue in Windows' anti-DoS software[4], to terminate security software, allowing the group to evade detection. The group is further noted for having a deep understanding of Microsoft Azure, and is also able to conduct reconnaissance in cloud computing platforms powered by Google Workspace and AWS, and has used legitimately-developed remote-access tools.[1]
The group later became known for targeting critical infrastructure prior to moving on to its 2023 casino hacks.[5]
2023 casino hacks
Scattered Spider gained access to both Caesars' and MGM's internal systems through the use of social engineering. Upon the announcement of both companies' attacks, the stock prices for both MGM and Caesars dropped. The group was able to bypass multi-factor authentication technologies by attaining login credentials and one-time passwords.[6][7]
MGM hack
Scattered Spider collaborated with ALPHV, a software development team which provides ransomware as a service. Scattered Spider called MGM's help desk posing as an employee it found on LinkedIn to gain internal access. The group gained access on September 11, 2023.[6]
MGM Resorts first disclosed the cyberattack on September 12, 2023, in a regulatory filing. The company stated that though it has "dealt" with the cyberattack, many of the computer systems at its resorts remain offline, which include but are not limited to credits for food, beverages, and free credits. The attack further disabled on-site ATMs as well as remote room keys, and prevented MGM from charging patrons for parking.[7]
MGM and the US FBI are presently investigating the cyberattack, and the casino operator has taken down it's website.[3] Moody's Corporation has stated that due to MGM's heavy reliance on computers for much of its operations, it's credit rating could go down as a result of the cyberattack.[5]
Caesars hack
Caesars Entertainment paid a ransom of $15 million to Scattered Spider, half their original demand of $30 million. Scattered Spider, using similar tactics to its attack on MGM, was able to access driver's license numbers and possibly Social Security numbers, for a "significant number" of Caesars customers.[2][8]
Statements made by Caesars noted that while the company cannot guarantee the deletion of the information attained by Scattered Spider, the casino operator will take all necessary actions to attain such result.[2]
References
- ^ a b c "Scattered Spider: The Modus Operandi". www.trellix.com. Retrieved September 14, 2023.
- ^ a b c "Caesars Entertainment says it was also a victim of a cyberattack". NBC News. September 14, 2023. Retrieved September 14, 2023.
- ^ a b Bracken, Becky (September 14, 2023). "'Scattered Spider' Behind MGM Cyberattack, Targets Casinos". Dark Reading. Retrieved September 14, 2023.
- ^ "CVE-2015-2291 : (1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows all". www.cvedetails.com. Retrieved September 14, 2023.
- ^ a b "MGM Resorts breached by 'Scattered Spider' hackers: Sources". Business Insurance. Retrieved September 14, 2023.
- ^ a b Siddiqui, Zeba; Bing, Christopher; Bing, Christopher (September 13, 2023). "MGM Resorts breached by 'Scattered Spider' hackers: sources". Reuters. Retrieved September 14, 2023.
- ^ a b "Young hackers are sticking up Las Vegas casinos for hefty ransoms". Quartz. September 14, 2023. Retrieved September 14, 2023.
- ^ "Caesars Entertainment says it was also a victim of a cyberattack". NBC News. September 14, 2023. Retrieved September 14, 2023.