How Scattered Spider Hacked a Logistics Firm

Hackers associated with Scattered Spider have been on a hacking tear, displaying resolve and cleverness in social engineering techniques to gain initial access, researchers warn of the native English-speaking, adolescent-dominated cybercrime collective.

See Also: Live Webinar | AI-Powered Defense Against AI-Driven Threats

Also tracked as Octo-Tempest and UNC3944, the group uses social engineering skills to gain initial access to a victim’s network in order to steal data, encrypt files and hold companies ransom.

Tricking corporate help desks is a specialty, buoying the group into $15 million worth of paid-out extortion money from victims including Las Vegas giant Caesars Entertainment.

In an attack last month against an organization in the logistics sector, attackers displayed persistence, technical sophistication and tenacity when breaching a victim’s IT environment, including the ability to evade defenses, escalate privileges and maintain access despite repeated attempts to eject them, says a Friday report from ReliaQuest.

One takeaway is the proficiency attackers displayed from the earliest stages. They focused on members of the C-suite and gathered publicly available intelligence to home in on C-level executives’ credentials. Attackers appear to have gleaned the CFO’s date of birth and the last four digits of the CFO’s Social Security number, which enabled the attackers to use the company’s public-facing Oracle Cloud portal to confirm the executive’s employee number.

“In the next stage of the attack, Scattered Spider demonstrated its social engineering expertise by impersonating the organization’s CFO in a convincing call to the IT help desk,” said ReliaQuest’s Threat Research Team. “By presenting a plausible scenario and exploiting the inherent trust placed in executive-level requests, the attackers successfully persuaded help-desk staff to reset the MFA device and credentials tied to the CFO’s account.”

Many of Scattered Spider’s members appear to be native English-speaking teenagers or young adults who reside in the U.S. or the United Kingdom.

After successfully gaining network access to the logistics firm, the attacker – or attackers – involved displayed their technical chops, including by enumerating IDs via the organization’s Microsoft Entra ID cloud-based identity and access management system. They also dumped the NTDS.DIT core database that powers Active Directory and raided the company’s CyberArk Vault, stealing secrets tied to 1,400 accounts.

A timeline of the attack shows how the Scattered Spider attack unfolded. Some notable takeaways include:

• Day 1: Attackers’ first attempts to authenticate to Oracle Portal using stolen CFO credentials fail thanks to multifactor authentication.
• Day 2: Attacker socially engineers the help desk, gaining access to CFO’s accounts, and later accounts for IT users. They gain access to VMware Horizon virtual desktop infrastructure instances, and the company’s CyberArk Vault, and assign an Exchange administrator role to a compromised account. They also access mailboxes used by the CISO and other high-level employees, and then to the company’s account with data warehouse-as-a-service provider Snowflake, through single sign-on authentication.
• Day 3: The security team begins responding to intrusion, leading the attacker to disable multiple security team accounts.
• Day 4: Efforts to remove the threat actor – only for them to regain access – continue, causing some collateral damage along the way, including the threat actor deleting Azure firewall policies, disrupting business operations. About 62 hours after first breaching the victim’s network, the threat actor finally gets fully ejected.

After defenders ejected the threat actor, they spotted repeat attempts to regain access by using valid passwords. Attackers had successfully cracked hashes for some of the relatively weak – or reused – passwords from the PAM vaults they stole. The login attempts triggered multifactor authentication requests, making them unsuccessful.

One of the major takeaways is that many organizations are highly vulnerable to the type of social engineering at which members of Scattered Spider repeatedly excel.

“This attack underscores the critical need to secure human workflows alongside technical defenses, as it’s clear from this attack that advanced threats exploit gaps in both areas,” ReliaQuest said.

Security experts expect attacks that trace to Scattered Spider to continue, despite the ongoing arrests of alleged members (see: Suspected Scattered Spider Head Extradited From Spain).

After appearing to go quiet early this year, attacks traced to members of the group surged in recent months, with hits on British retailers such as Marks & Spencer and the Co-op Group. More recently, further victims of the group likely include Aflac, America’s largest provider of supplemental health insurance, as part of what researchers say is a new campaign targeting U.S. insurers.

In a recent report, cybersecurity firm Halcyon said the group appears to draw on a large stable of ransomware operation relationships. After infiltrating an organization, oftentimes “within hours, the attackers exfiltrate sensitive data before deploying DragonForce, Qilin, Akira or Play ransomware,” Halcyon said.