To counter this threat, Silent Push has developed Indicators of Future Attack (IOFA) feeds that track Scattered Spider infrastructure, including recently observed domains like “klv1.it.com” targeting Klaviyo and multiple others impersonating corporate services. This domain, likely part of a previous brand protection effort by Twitter, changed hands multiple times – initially registered on Porkbun in June 2022, taken over by Twitter (working with brand protection vendor CSC) by August 2022, and then reacquired by Scattered Spider in October 2024 through NiceNIC, their current registrar of choice. Scattered Spider, a notorious hacker collective active since at least 2022, continues to launch increasingly sophisticated social engineering attacks aimed at stealing usernames, login credentials, and multifactor authentication (MFA) tokens. In early 2025, Silent Push researchers discovered Scattered Spider’s updated arsenal now includes a new version of Spectre RAT (Remote Access Trojan), a sophisticated malware that enables persistent access to compromised systems. Operating as part of a larger hacking collective known as “The Community” or “The Comm,” Scattered Spider has developed a reputation for conducting meticulous research on their targets before launching attacks. The group, also known as UNC3944, Star Fraud, Octo Tempest, Scatter Swine, or Muddled Libra, has been linked to several high-profile security breaches, including the Twilio incident in August 2022 and the MGM breach in September 2023. Silent Push researchers have successfully identified five distinct Scattered Spider phishing kits being used since at least 2023, with some showing several iterations and updates. Recent findings from Silent Push analysts reveal a significant development: Scattered Spider has acquired a domain (twitter-okta.com) previously owned by Twitter/X. The malware incorporates a sophisticated debug logging system that records errors with specific codes, such as “100 10010” for invalid beacon responses and “100 10002” for installation path issues.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 10 Apr 2025 08:10:13 +0000