A look at Scattered Spider, which experts say is a group of 17- to 22-year-old native English speakers likely behind MGM and 52+ other hacks since March 2022
About a year ago, the U.S. security firm Palo Alto Networks began to hear from a flurry of companies that had been hacked in ways that weren't the norm for cybercriminals.
Reuters
Context & Ripple Effects
The MGM incident had already been tied to help-desk calls used to obtain passwords, making the group profile consequential: it frames the intrusion as a repeatable social-engineering method rather than an isolated failure.
Later coverage of investigators’ knowledge of alleged participants suggests attribution alone does not quickly neutralize a loosely organized threat network.
First-order effects
MGM and other potential targets gain a clearer indicator of the threat they face: English-language social engineering directed at employee support channels.
Security teams must treat help-desk identity verification as a frontline control, not merely an administrative process, when responding to activity associated with Scattered Spider.
Second-order effects
Organizations with outsourced IT support or password-reset workflows face pressure to tighten escalation, authentication, and monitoring practices, potentially increasing friction for legitimate employees.
The alleged group’s scale and repeated targeting make peer intelligence-sharing more valuable, because a technique seen at one company can signal exposure at another.
Third-order effects
If this pattern persists, cyber resilience will depend as much on defending human access-recovery processes as on protecting technical infrastructure.
The gap between identifying young, distributed operators and stopping them may keep ransomware and extortion campaigns viable even when investigators can attribute attacks.
The trend: Scattered Spider is one data point in the shift toward cyber intrusions that exploit trusted employee-support workflows rather than relying solely on software vulnerabilities.
Okta and Azure: The attackers had super admin privileges to MGM's Okta and Global Admin privileges to their Azure tenant. Both of these vendors have been plagued by phishing attacks for months. [image]
Network Infiltration: MGM's network was infiltrated for days. Ten days later, the company is returning to somewhat normal operations. Though they are posting jobs basically begging for low-end help to come to work endlessly to rebuild from the ground up. [image]
“the term Scattered Spider isn't accurate, the researchers at LABScon said, as it lumps the activities of multiple disparate and sometimes rival groups from within the Com ecosystem into one entity.” 📣 evidence-based activity sets aren't defined by people Good stuff though.
“Recent hacks of Caesars Entertainment and casinos owned by MGM were probably carried out by teens and young adults who have allied themselves with one of the world's most notorious ransomware gangs, part of a trend that has alarmed security experts.” https://www.washingtonpost.c…
the cyberattack was carried out by teens and young adults that are a part of a notorious ransomware gang known to many security firms as “Scattered Spider”— Good because why are Casino's not employing top cyber-security as if our whole generation didn't grow up on Ocean's films?
🧵: Everything We Know About the MGM and Caesar's Hacks The Big Picture: Both casinos faced significant cyberattacks due to phishing employees' Okta accounts.
Hackers “tied to Scattered Spider placed bogus emergency calls to summon heavily armed police units to the homes of executives of targeted (companies, a) technique, called SWATing,” report @zebatweets & @razhael. https://www.reuters.com/...
An excellent article by @zebatweets and her Reuters colleagues on the #MGM hack - a relatively new #cybercrime gang known as ‘scattered spider’ has come into the limelight after the breach for their ruthless and meticulous attack methods. https://www.reuters.com/...
More details on the Mgm / Caesar Las Vegas attack and the way modern cybercriminals work and collaborate with RaaS (Randomware as a servive) providers. https://www.reuters.com/...
Keep an eye on the gang of young cybercriminals who hacked Caesars & MGM. They're prolific, patient, talented, and “ruthless,” and researchers are now speaking up to warn the world not to underestimate them. https://www.reuters.com/... https://www.washingtonpost.com/ ... https:…