Scattered Spider Tied Fresh Attacks on Financial Services

Elements of a notorious cybercrime and ransomware group mashup appear to be carrying on, despite retirement claims.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

A member of the band of native English-speaking adolescent hackers lately calling itself Scattered Lapsus$ Hunters published Friday a semi-coherent screed proclaiming the collective would be “going dark.” Many cybersecurity experts responded with skepticism.

Evidence suggests that at least some members of the loose-knit hacking collective are continuing to hit targets.

Threat intelligence firm ReliaQuest said it’s still seeing known indicators of compromise tied to Scattered Spider.

The firm said a U.S. banking organization – it didn’t name which one – fell victim to a technically sophisticated Scattered Spider attack that occurred after the retirement announcement. The attacker attempted to steal data from multiple repositories, including the victim’s accounts with Amazon Web Services and cloud-based data platform Snowflake.

“Scattered Spider gained initial access by socially engineering an executive’s account and resetting their password via Azure Active Directory Self-Service Password Management. From there, they accessed sensitive IT and security documents, moved laterally through the Citrix environment and VPN, and compromised VMware ESXi infrastructure to dump credentials and further infiltrate the network,” ReliaQuest said. “To escalate privileges, the attacker reset a Veeam service account password, assigned Azure Global Administrator permissions and relocated virtual machines to evade detection.”

The financial services sector appears to remain at high risk of attack by the group. Over the past two months, elements of Scattered Spider registered “a coordinated set of ticket-themed phishing domains and Salesforce credential harvesting pages” designed to target the financial services sector as well as providers of technology services, suggesting a continuing focus on those sectors, ReliaQuest said.

Registering lookalike domain names is a repeat tactic used by many attackers, from Chinese nation-state groups to Scattered Spider. Such URLs are designed to trick victims into thinking a link that they visit is legitimate.

In the case of Scattered Spider, the group has “frequently registered domains with keywords like okta,, helpdesk and sso, often formatted with hyphens, e.g., SSO-company.com,” in reference to single sign-on, ReliaQuest said. “These domains were registered using infrastructure associated with phishing kits commonly used to host single sign-on login pages – a calling card of Scattered Spider’s previous SSO-themed attacks spoofing brands like Okta.”

The Aug. 1 registration of the domain name dashboard-salesforce.com, which was being used for targeted phishing attacks against Salesforce customers, also appeared to be the work of Scattered Spider, it said.

Repeat Tactics and Success

Members of Scattered Spider and ShinyHunters excel at social engineering, including voice phishing, aka vishing. This often involves tricking a help desk into believing the attacker is a legitimate employee, leading to passwords being reset and single sign-on tokens intercepted. In some cases, experts say, the attackers trick a victim into visiting lookalike support panels they’ve created which are part of a phishing attack.

Since the middle of the year, members of Scattered Spider have breached British retailers Marks & Spencer, followed by American retailers such as Adidas and Victoria’s Secret. The group has been targeting American insurers such as Aflac and Allianz Life, global airlines including Air France, KLM and Qantas, and technology giants Cisco and Google.

More recently, the group stole customer data from both British carmaker Jaguar Land Rover and Paris-based Kering, which operates the fashion brands Gucci, Balenciaga and McQueen.

Many times, the attackers’ aim has included gaining access to the organization’s Salesforce instance, after which they exfiltrate large amounts of data.

Security experts have been tracking this cluster of threat activity, seen beginning in October 2024, as UNC6040.

“UNC6040 threat actors commonly call victims’ call centers posing as IT support employees addressing enterprise-wide connectivity issues,” the FBI said in a Friday advisory. “Under the guise of closing an auto-generated ticket, UNC6040 actors trick customer support employees into taking actions that grant the attackers access or lead to the sharing of employee credentials, allowing them access to targeted companies’ Salesforce instances to exfiltrate customer data.”

UNC6040 attacks regularly result in a victim receiving an extortion demand from someone claiming to be a member of the ShinyHunters group, seeking a cryptocurrency ransom payment in return for a promise to not leak the stolen data, the FBI said. These extortion demands can arrive “days to months” after the intrusion and data exfiltration, it said.

The group now calling itself Scattered Lapsus$ Hunters sprang from a loose-knit cybercrime collective known as The Com, which formed by 2022, experts said. Initially, Scattered Spider and ShinyHunters appeared to be related but separate efforts.

More recently, members of the overarching effort – given the tongue-in-cheek name Scattered Lapsus$ Hunters – suggested there’s a high degree of crossover, to the extent that they were slapping one or the other group’s name on an attack, depending on the outcome. Scattered Spider referred to attacks by the group that involved data exfiltration and ransomware, while ShinyHunters attacks involved solely data exfiltration. In either case, the financially motivated attackers typically focused on extorting victims (see: Scattered Spider and ShinyHunters’ Next Move: Leaking Data).