The Scattered Spider cybercriminal group is targeting victims’ data storage tools after gaining initial access by impersonating contracted information technology (IT) help desks. In “many” incidents, Scattered Spider was seen searching for an organization's Snowflake access in order to steal large volumes of data, the advisory said. Government agencies in the U.S., U.K., Canada and Australia updated an advisory initially released in November 2023 about the group — which has recently caused alarm with back-to-back campaigns targeting large companies in the retail, insurance and airline industries. The FBI and others said the group is now posing as employees of targeted companies to convince IT teams or help desk staff to provide login information, passwords or other access through devices. Hackers connected to Scattered Spider are now using remote access tools like AnyDesk to bypass security alerts and deploying malware to maintain access while conducting internal reconnaissance. The group has also been seen purchasing employee or contractor credentials on cybercriminal forums like Russia Market or compromising third party services that have access to the networks of potential targets. Scattered Spider — a large, loosely affiliated network of hackers — has continued to evolve its tactics over the years but continues to sporadically turn back to tried-and-true methods like phishing. “It is common for the threat actors to gather the personally identifiable information (PII) of users with elevated access to their network using online open-source information,” the agencies explained. “While Scattered Spider initially began their activity relying upon broad phishing campaigns, the threat actors are now employing more targeted and multilayered spearphishing and vishing operations. Using “layered social engineering techniques,” the hackers figure out what they need to convince IT help desks to give them access to an employee’s account. The data storage company serves many large organizations, but those clients are responsible for maintaining access credentials. The advisory notes that the DragonForce ransomware was used in several incidents, allowing the hackers to monetize their access, steal data and more. Year of law enforcement action against alleged members of the group have done little to stop it from continuing to wage successful campaigns against large companies.
This Cyber News was published on therecord.media. Publication date: Tue, 29 Jul 2025 18:25:28 +0000