Scattered Spider Suspected Behind Qantas Data Breach

The band of English-speaking adolescent hackers collectively tracked as Scattered Spider is focusing on the airlines – and possibly preparing a pivot to the oil and gas sector.

See Also: Live Webinar | AI-Powered Defense Against AI-Driven Threats

Australian airliner Qantas divulged Wednesday that hackers breached its call center to access a third-party system containing customer data. The breach impacted six million customers, exposing customer names, email addresses, phone numbers, birth dates and frequent flyer numbers. Qantas has not confirmed being a target of Scattered Spider, but the attack has the hallmarks of a Scattered Spider operation – including the social engineering attack on a call center.

The company said it detected the breach on Monday and that it took the impacted systems offline. The incident did not expose payment details or impact its services, Qantas added.

Hawaiian Airlines similarly on Thursday disclosed a breach, which security experts believe is linked to Scattered Spider. Canadian airliner WestJet disclsoed on June 13 a cyber incident apparently part of the Scattered Spider wave.

The financially motivated threat group, consisting primarily of U.S. and British residents, once garnered a designation from Microsoft as “one of the most dangerous financial criminal groups” following a run of disruptive attacks against Las Vegas casinos. Its loose membership tends to hyperfocus on single sectors at a time – with British retail and American insurance firms recently taken their turn as targets.

Also tracked as Octo Tempest and Roasted 0ktapus and UNC3944, the group emerged in 2022 from an online community of juvenile hackers calling itself “The Community,” aka the Com. It has attacked at least 130 companies. The threat group typically impersonates employees or contractors to trick IT help desk services to bypass multifactor authentication or convince help desks to add unauthorized MFA devices to compromised accounts, warned the FBI in a Friday missive alerting the airline sector about Scattered Spider’s new focus.

“They target large corporations and their third-party IT providers, which means anyone in the airline ecosystem, including trusted vendors and contractors, could be at risk,” the bureau said.

“Given the habit of this actor to focus on a single sector, we suggest that the industry take steps immediately to harden systems,” said Charles Carmakal, CTO of Google-owned threat intel firm Mandiant. “Organizations can take proactive steps like training their help desk staff to enforce robust identity verification processes and deploying phishing-resistant MFA to defend against these intrusions.”

Researchers from cybersecurity platform firm Doppel reported Tuesday they detected an uptick in registrations of new domains mimicking legitimate corporate and authentication services, a known Scattered Spider technique. Between March 30 and June 30, registration of domains with keywords such as “support,” help” and “service” notably increased. “We detected nearly three times as many deceptive domain registrations across our customer base for the same keywords when compared to our detections for the previous three-month period,” Kevin Tian, Doppel cofounder and CEO, said in an email.

The highest volume of domain registrations with those keywords occurred in domains with a connection to the aviation sector – and the oil and gas sector, Doppel found.

“We don’t have definitive attribution on Scattered Spider targeting oil and gas and are not directly indicating claiming oil and gas is next,” Tian cautioned. “However, when we looked at the patterns across our customer base, we saw a notable increase in alerts for critical infrastructure organizations, including aviation and oil and gas.”