MGM Security Incident

Table of Contents What Does This Tell Us? Common Attack Tactics, Techniques, and Procedures (TTPs) Key Learnings and Preventative Measures The Importance of a Risk-Based Vulnerability Management (RBVM) Program As many are aware, the systems of the $14 billion dollar gaming and hospitality giant MGM have been brought to a halt for nearly 5 days due to a multi-vector attack that has come to affect Caesars Entertainment as well. While the culprits of the attack are not confirmed, hacking group Scattered Spider , who is also associated with UNC3944-related groups Scatter Swine, Oktapus, and Muddled Libra , has been suspected to be the attacker. This attack is notable not only because of its scope but also due to its use of ransomware made by ALPHV or BlackCat (Ransomware-as-a-Service), suggesting that the UNC3944 threat cluster is likely here to stay and expand. Since 2022, the UNC3944 threat cluster has always deployed social engineering and SMS phishing campaigns (smishing) to obtain credentials to gain access and expand within a victims network. However, in 2023, UNC3944 began to evolve to muster advanced ransomware attacks targeting an array of private sector companies MGM just being the most infamous of late. What Does This Tell Us? The message is clear with the evolution of the UNC3944 threat cluster and the use of ALPHV or BlackCat (Ransomware-as-a-Service). Ransomware attacks are growing more lucrative and, therefore, common. Attacker tactics, techniques, and procedures (TTPs) will continue to expand in their scope and complexity. Even the most advanced and well-funded attack cluster, as in the case of UNC3944, still relies heavily on old-fashioned, persistent phone-based social engineering bto begin their attack, highlighting the importance of cybersecurity training and rigorous zero-trust networking access (ZTNA) policies to reduce lateral movement after attackers gain entry into a victims infrastructure. Common Attack Tactics, Techniques, and Procedures...

... (truncated for display)