The U.S. Cybersecurity and Infrastructure Security Agency (CISA), with the FBI and international partners from Canada, Australia, and the UK, issued an updated joint advisory on July 29, 2025, addressing the ongoing threat posed by the cybercriminal group Scattered Spider. This group is notable for its rapidly evolving tactics, advanced social engineering, and impact on commercial and critical infrastructure sectors.
1. Main Threat Overview
- Nature of Group: Scattered Spider is a financially motivated threat actor, active since at least 2022, who targets large enterprises across various industries. The group is also tracked as UNC3944, Octo Tempest, and Muddled Libra.
- Note: Alias names can cause confusion in security reporting. Always cross-check IoCs and TTPs under related names when reviewing incident data.
- Targeting Sectors: Sectors attacked include telecommunications, technology, business process outsourcing, financial, retail, insurance, and aviation[5].
- Note: The group pivots focus between sectors, exploiting the weakest link or most lucrative opportunity identified at a given time.
2. Attack Techniques (TTPs)
- Social Engineering Attacks: The group excels in phishing, vishing (voice calls), push bombing (flooding users with MFA prompts), and SIM-swapping to bypass security controls and capture credentials.
- Note: Social engineering is often the initial access vector. Internal employees, especially IT/helpdesk, are prime targets.
- Remote Access & Malware: Once initial access is granted, they use legitimate remote access tools (e.g., AnyDesk, TeamViewer), often as “portable” single-file applications to evade detection by traditional security software.
- Living-off-the-Land: Attackers leverage legitimate system tools (so-called “living-off-the-land”), making detection more difficult.
- Example: Using PowerShell scripts or scheduled tasks for persistence.
- Credential & MFA Manipulation: They regularly manipulate victims or support staff into revealing credentials or MFA codes.
- Note: Even “strong” MFA is not foolproof against well-resourced social engineers.
- Use of Ransomware & Data Exfiltration: The advisory highlights newer ransomware families, such as DragonForce, plus prior links to ALPHV/BlackCat, combined with data theft and extortion demands.
- Indicators of Compromise (IoCs): Tactics include registering typosquatted domains (e.g., sso.company.com instead of sso-company.com), and the use of specific remote access tools, and deploying ransomware post-infiltration.
- Note: Monitoring for newly registered lookalike domains is recommended.
3. Recent Campaigns (Apr-Jul 2025)
- Retail: Large-scale attacks in the UK (Marks & Spencer, Harrods) and US.
- Insurance: U.S. insurance companies like Aflac, Erie Insurance, and Philadelphia Insurance companies affected.
- Aviation: Attacks on airlines (Hawaiian Airlines, WestJet, Qantas) affecting customer records but not flight operations.
- Note: The rapid pivot between sectors underscores a highly adaptive group. Review sector-specific guidance.
4. Mitigation Recommendations
- Backups: Maintain offline, regularly tested backups, stored separately from operational data.
- Note: Backups should not be accessible from the primary network to guard against ransomware impact.
- Phishing-Resistant MFA: Enforce phishing-resistant MFA (FIDO/WebAuthn or hardware tokens). Avoid “push” MFA if possible, as attackers exploit fatigue with repeated prompts.
- Note: SMS and push-based MFA are vulnerable to both SIM-swapping and social engineering.
- Application & Remote Access Controls:
- Implement strict application allowlisting, especially for remote access tools.
- Audit all remote access tools and block unauthorized ones.
- Limit remote access to VPN or VDI from inside the network only.
- Log and investigate anomalous remote access activity.
- Audit & Network Security: Regularly review password policies according to NIST guidance; apply a zero-trust model where possible.
- Note: Focus not just on users, but IT support and help desk staff awareness.
- Incident Response: Ensure incident response plans are tested, up-to-date, and mapped to the MITRE ATT&CK framework techniques seen in advisory.
- Reporting: Promptly report incidents to authorities. The advisory strongly discourages paying ransoms, as it does not guarantee recovery and may encourage further criminal activity.
5. Additional Notes
- Why so much focus on social engineering? Scattered Spider’s main strength is manipulating humans, which can bypass even advanced technical controls. Thus, user training, helpdesk procedure reviews, and regular phishing simulation exercises are critical.
- IOC Usefulness: The CISA advisory links to detailed IoC lists including suspicious domains, tools, and TTPs for defenders to use in detection—review and integrate these into security monitoring.
- Evolving Threat: The joint advisory is updated frequently as TTPs change. Routinely check CISA and partner sites for emerging details.
