Scattered Spider Chases Clout via Social Engineering Scams

The hacking group known as "Scattered Spider" has been making headlines lately, and for good reason. In recent months, the gang has successfully breached the systems of several high-profile companies, including British retailer Marks & Spencer (M&S), and has been using its signature social engineering tactics to trick employees into sharing sensitive information.

According to a report by the Financial Times (FT), Scattered Spider's approach involves conducting thorough research on company employees before making contact with them. The hackers then use this information to impersonate the employees over the phone, convincing other colleagues to share their passwords and other sensitive details. This tactic has allowed Scattered Spider to carry out high-profile attacks, including a breach at MGM Casinos and Resorts in Las Vegas in 2023 that brought the hotel chain to a standstill.

The attack on M&S is particularly noteworthy, as it resulted in the company losing up to $403 million in operating profits and erasing over $807 million in market capitalization. However, what's even more striking about Scattered Spider's methods is its motivations. According to Charles Carmakal, chief technology officer at the Google-owned Mandiant Consulting, the hackers are not solely motivated by financial gain. "They're not exclusively financially motivated — they like the clout, they like the mainstream media attention," Carmakal told the FT.

This desire for attention and recognition is a key factor in Scattered Spider's success. The group's attacks often receive widespread media coverage, which helps to amplify their reputation and attract even more victims. As threat researcher Zach Edwards noted, "They tend to hit a bunch of companies in the same sector for a few weeks before they move on." This predictable pattern makes it essential for companies to take proactive measures to protect themselves.

Cybersecurity professionals are sounding the alarm about Scattered Spider's tactics, with many reporting an increase in calls from companies affected by the group's attacks. "We've been getting SOS calls from companies telling us that they're dealing with an active attack," said Carmakal. To address these threats, experts recommend a range of strategies, including least privilege access, separation of duties, and monitoring and alerting on suspicious activities.

Behavioral monitoring is also becoming increasingly important in preventing social engineering attacks like those carried out by Scattered Spider. According to Randolph Barr, CISO of Cequence Security, "There are standard approaches to addressing such threats... Behavioral monitoring is another key area, and we will likely hear more about its role in future security solutions and controls." By taking these measures, companies can reduce their risk of falling victim to social engineering scams like those carried out by Scattered Spider.

As the threat landscape continues to evolve, it's essential for companies to stay vigilant and take proactive steps to protect themselves. With Scattered Spider's tactics continuing to be effective, it's clear that social engineering remains a major concern in the world of cybersecurity.