The MGM Resorts cyberattack that struck on September 10th has been attributed to a threat group known as “Scattered Spider,” shedding light on the operations of this youthful collective. The attack has left systems offline across MGM Resorts’ extensive network of over 30 hotels and casinos worldwide, with ongoing consequences.
Scattered Spider, believed to consist of young adults from the US and UK, has garnered notoriety for its social engineering tactics. These schemes involve tricking individuals into divulging login credentials, highlighting the group’s cunning nature. Scattered Spider operates as an affiliate for the BlackCat/ALPHV ransomware.
In a recent development, Scattered Spider also targeted Caesars Entertainment, a major player in the hospitality industry. Caesars reportedly paid a ransom in the tens of millions to the cyberattackers, according to Bloomberg. The attack on Caesars began in late August, further underscoring the group’s audacity.
Scattered Spider’s modus operandi combines credential phishing with social engineering, enabling them to capture one-time-password (OTP) codes and overwhelm targets with multifactor authentication (MFA) notification tactics. Instead of relying on unique malware, the group prefers to use legitimate remote management tools to maintain persistent access, as outlined in a CrowdStrike report from January.
As the investigation into the MGM Resorts breach continues, the conglomerate’s websites remain offline. The Scattered Spider group’s audacious cyberattacks highlight the evolving landscape of cyber threats and the need for vigilance in the face of these sophisticated adversaries.