Sandfly Security Security Incident

This newsletter is brought to you by Sandfly Security . You can subscribe to an audio version of this newsletter as a podcast by searching for "Risky Business" in your podcatcher or subscribing via this RSS feed . Individuals associated with a large cluster of hackers known as Scattered Spider ( Muddled Libra , UNC3944 ) are targeting companies in the aviation and transportation sectors. The group, which was previously very active in 2023 and had some members arrested in 2024, saw a resurgence in activity this year. It returned with a bang with attacks that targeted UK retail chains, moved to go after US retailers , and then targeted US insurance businesses before a new change in targets this month. Google , Palo Alto Networks , and the FBI have put out public statements on Friday warning about the group's new shift towards aviation. The three warnings come after WestJet and Hawaiian Airlines disclosed breaches this month. Reports from Axios and Bleeping Computer claim the two companies were hit by the group. Scattered Spider's hacking spree this year also included intrusions at UK retail chains Mark & Spencers and Co-op. While still unconfirmed, three insurance companiesAflac, Eerie Insurance, and Philadelphia Insurancealso disclosed security breaches shortly after reports that the group shifted to target their industry vertical. "Scattered Spider has a history of focusing on sectors for a few weeks at a time before expanding their targeting," Charles Carmakal, Google Mandiant CTO, wrote on LinkedIn. Carmakal urged companies to read guidance on the group's normal TTPs and take preemptive measures. "The actor's core tactics, techniques, and procedures have remained consistent. This means that organizations can take proactive steps like training their help desk staff to enforce robust identity verification processes and deploying phishing-resistant MFA to defend against these intrusions," Carmakal told Risky Business . "We are still working on attribution and...

... (truncated for display)