MGM was likely hacked by Scattered Spider, an English-speaking group that previously used help desk calls to get passwords and planned to hack the slot machines

Person claiming to represent cybercriminals explains techniques used to evade detection by casino resort company

Financial Times 2023-09-15 Mehul Srivastava

Discussion

@vxunderground @vxunderground on x
All ALPHV ransomware group did to compromise MGM Resorts was hop on LinkedIn, find an employee, then call the Help Desk. A company valued at $33,900,000,000 was defeated by a 10-minute conversation.
@vxunderground @vxunderground on x
When Scattered Spider compromised MGM they tried to modify code for the slot machines to make them spit out money 😂😂 These nerds are going full Ocean's Eleven
@_sn0ww Snow on x
Chances are, if you stopped in the @sec_defcon this year at @defcon, you heard first hand how successful #vishing can be. 🧵
@vxunderground @vxunderground on x
@let_svn No, this isn't an attempt to screw anyone over. This particular subgroup of ALPHV ransomware has established a reputation of being remarkably gifted at social engineering for initial access. It isn't really a surprise ALPHV (or the subgroup) is behind this attack.
@racheltobac Rachel Tobac on x
One of the easiest ways for me to hack is simply: 1. Look up who works at a org on LinkedIn 2. Call Help Desk (spoof phone number of person I'm impersonating) 3. Tell Help Desk I lost access to work account & help me get back in I hope we learn more & get confirmation of methods
@vxunderground @vxunderground on x
@arborbytes The Threat Actors themselves
@vxunderground @vxunderground on x
Very cool. Thank you @Bitdefender and @TrustedSec for the kind words when speaking with @Forbes. However, we would like to note vx-underground is a collective of several people - it is not a single person. (TrustedSec knows this, maybe Mr. Hammerstone made an oopsie doopsie) [ima…
r/technology r on reddit
Hackers claim it only took a 10-minute phone call to shut down MGM Resorts
@zackwhittaker@mastodon.social Zack Whittaker on mastodon
Bloomberg is reporting that the same hackers who took down MGM Resorts this week recently targeted Caesars Entertainment, which paid millions in ransom to stop the publishing of its sensitive information. — The hacking group behind the attacks is believed to be Scattered Spider…
@waxmonkey.bsky.social @waxmonkey.bsky.social on bluesky
im tellin ya griftops, casinos have the cash and the motivation to end things quickly and quietly so stay the fuck away from public utilities and schools and shit and go where the money is high and the transparency is low and i will hate you ten to fifteen percent less [embedded …
@mranthropology.bsky.social Rich Stroffolino on bluesky
Interesting timing considering the MGM attack 👀 [embedded post]
@vxunderground @vxunderground on x
Do wE kNoW iF CaEsArS wAs HaCkeD?! Yes, they were compromised around the exact same time as MGM and access to Caesar's was compromised using the exact same technique that was used against MGM. Read the U.S. Securities and Exchange Commission report, nerds. [image]
@andrewshikiar Andrew Shikiar on x
I'm often asked about FIDO ROI calculators.. no need to sharpen your pencils for this one: Option 1: pay ransomware thugs $15M+ after they social engineer password from your IT team Option 2: deploy FIDO Security Keys, which prevent MFA bypass attacks https://www.wsj.com/...
@bushidotoken Will on x
Caesars “identified suspicious activity in its [IT] network resulting from a social engineering attack on an outsourced IT support vendor” they use Circumstantial evidence here, but this is similar to prior #ScatteredSpider attacks on BPO firms https://www.crowdstrike.com/ ...
@hackinglz Justin Elze on x
I'm not sure why casinos wouldn't pay a ransomware group. The loss per hour/day they face is on the extreme side compared to many other targeted verticals. The obvious downside here is it fuels capabilities, but the business side of paying is logical, assuming they use this event…
@snlyngaas Sean Lyngaas on x
Then there's this sentence 🧐 ; ) “We have taken steps to ensure that the stolen data is deleted by the unauthorized actor, although we cannot guarantee this result.”
@mcgrewsecurity Dr. Wesley McGrew on x
Ransoms have been being paid across industries, which is why it's been “open season” pretty consistently for ransomware for the past decade. This almost certainly isn't even the first casino/resort company that's paid.
@carlypage_ Carly Page on x
Caesars Entertainment has confirmed that hackers stole a huge trove of customer data in a recent cyberattack, including driver's license numbers and Social Security numbers for a “significant number of members”. @zackwhittaker has more: https://techcrunch.com/...
@williamturton William Turton on x
caesars just confirmed it was hacked in an SEC filing just now [image]
@vitalvegas Vital Vegas on x
Rumors of Caesars Entertainment paying $30 million to hackers in recent data breach are unfounded. That was the demand, the ransom paid was $15 million (covered by insurance), or about two hours of revenue in Caesars Palace high limit salon. https://www.casino.org/...
@rotopat Patrick Daugherty on x
Love the future
@mikko @mikko on x
«Our sources say Caesars Entertainment paid $15 million to the hackers to resolve its data breach. The original demand was $30 million. Caesars talked them down like an episode of “Pawn Stars.”» https://www.casino.org/...
@williamturton William Turton on x
scoop - caesars entertainment inc paid millions in a ransom to hackers in recent weeks. the hacking group responsible is believed to be comprised of people 19-22 years old in the US and UK. the same group hit MGM resorts. story tk 🎰
r/technology r on reddit
Caesars reportedly paid millions to stop hackers releasing its data | It's the second Las Vegas casino group to be attacked this week.
r/technology r on reddit
Over the past few weeks, MGM and Caesars were both hacked by one of the most ‘aggressive threat actors’ targeting the U.S.
r/vegas r on reddit
Caesars Entertainment Paid Millions in Ransom in Recent Attack
r/technews r on reddit
Caesars reportedly paid millions to stop hackers releasing its data | It's the second Las Vegas casino group to be attacked this week.

Chronicles

MGM was likely hacked by Scattered Spider, an English-speaking group that previously used help desk calls to get passwords and planned to hack the slot machines

Related Coverage

Discussion