Cybersecurity researchers have tied a recent spherical of cyber assaults focusing on monetary providers to the infamous cybercrime group often known as Scattered Spider, casting doubt on their claims of going “darkish.”
Risk intelligence agency ReliaQuest stated it has noticed indications that the menace actor has shifted their focus to the monetary sector. That is supported by a rise in lookalike domains doubtlessly linked to the group which might be geared in direction of the business vertical, in addition to a lately recognized focused intrusion towards an unnamed U.S. banking group.
“Scattered Spider gained preliminary entry by socially engineering an government’s account and resetting their password through Azure Lively Listing Self-Service Password Administration,” the corporate stated.
“From there, they accessed delicate IT and safety paperwork, moved laterally by way of the Citrix atmosphere and VPN, and compromised VMware ESXi infrastructure to dump credentials and additional infiltrate the community.”
To realize privilege escalation, the attackers reset a Veeam service account password, assigned Azure World Administrator permissions, and relocated digital machines to evade detection. There are additionally indicators that Scattered Spider tried to exfiltrate knowledge from Snowflake, Amazon Internet Companies (AWS), and different repositories.
Exit or Smokescreen?
The latest exercise undercuts the group’s claims that they had been ceasing operations alongside 14 different legal teams, comparable to LAPSUS$. Scattered Spider is the moniker assigned to a loose-knit hacking collective that is a part of a broader on-line entity referred to as The Com.
The group additionally shares a excessive diploma of overlap with different cybercrime crews like ShinyHunters and LAPSUS$, a lot in order that the three clusters shaped an overarching entity named “scattered LAPSUS$ hunters.”
Certainly one of these clusters, notably ShinyHunters, has additionally engaged in extortion efforts after exfiltrating delicate knowledge from victims’ Salesforce situations. In these circumstances, the exercise came about months after the targets had been compromised by one other financially motivated hacking group tracked by Google-owned Mandiant as UNC6040.
The incident is a reminder to not be lulled right into a false sense of safety, ReliaQuest added, urging organizations to remain vigilant towards the menace. As within the case of ransomware teams, there is no such thing as a such factor as retirement, as it is very a lot potential for them to regroup or rebrand beneath a special alias sooner or later.
“The latest declare that Scattered Spider is retiring ought to be taken with a major diploma of skepticism,” Karl Sigler, safety analysis supervisor of SpiderLabs Risk Intelligence at Trustwave, stated. “Relatively than a real disbanding, this announcement doubtless indicators a strategic transfer to distance the group from rising legislation enforcement stress.”
Sigler additionally identified that the farewell letter ought to be seen as a strategic retreat, permitting the group to reassess its practices, refine its tradecraft, and evade ongoing efforts to place a lid on its actions, to not point out complicate attribution efforts by making it more durable to tie future incidents to the identical core actors.
“It is believable that one thing throughout the group’s operational infrastructure has been compromised. Whether or not by way of a breached system, an uncovered communication channel, or the arrest of lower-tier associates, one thing has doubtless triggered the group to go darkish, at the very least briefly. Traditionally, when cybercriminal teams face heightened scrutiny or undergo inner disruption, they typically ‘retire’ in title solely, opting as a substitute to pause, regroup, and ultimately re-emerge beneath a brand new identification.”
