Within the wake of high-profile assaults on UK retailers Marks & Spencer and Co-op, Scattered Spider has been all around the media, with protection spilling over into the mainstream information as a result of severity of the disruption prompted — at the moment trying like tons of of thousands and thousands in misplaced income for M&S alone.
This protection is extraordinarily helpful for the cybersecurity group because it raises consciousness of the battles that safety groups are combating day-after-day. But it surely’s additionally created plenty of noise that may make it difficult to know the large image.
The headline story from the current marketing campaign in opposition to UK retailers is the usage of assist desk scams. This sometimes includes the attacker calling up an organization’s assist desk with some degree of knowledge — at minimal, PII that permits them to impersonate their sufferer, and typically a password, leaning closely on their native English-speaking skills to trick the assistance desk operator into giving them entry to a person account.
Assist Desk Scams 101
The purpose of a assist desk rip-off is to get the assistance desk operator to reset the credentials and/or MFA used to entry an account so the attacker can take management of it. They will use a wide range of backstories and techniques to get that achieved, however more often than not it is so simple as saying “I’ve received a brand new telephone, are you able to take away my present MFA and permit me to enroll a brand new one?”
From there, the attacker is then despatched an MFA reset hyperlink by way of e-mail or SMS. Normally, this could be despatched to, for instance, a quantity on file — however at this level, the attacker has already established belief and bypassed the assistance desk course of to a level. So asking “Are you able to ship it to this e-mail deal with” or “I’ve truly received a brand new quantity too, are you able to ship it to…” will get this despatched on to the attacker.
At this level, it is merely a case of utilizing the self-service password reset performance for Okta or Entra (which you will get round since you now have the MFA issue to confirm your self), and voila, the attacker has taken management of the account.
And one of the best half? Most assist desks have the identical course of for each account — it would not matter who you are impersonating or which account you are making an attempt to reset. So, attackers are particularly focusing on accounts more likely to have top-tier admin privileges — that means as soon as they get in, progressing the assault is trivial, and far of the everyday privilege escalation and lateral motion is faraway from the assault path.
So, assist desk scams have proved to be a dependable manner of bypassing MFA and reaching account takeover — the foothold from which to launch the remainder of an assault, comparable to stealing information, deploying ransomware, and many others.
Do not be fooled — this is not a brand new growth
However one thing that is not fairly coming throughout within the reporting is that Scattered Spider has been doing this efficiently since 2022, with the M&S and Co-op assaults merely the tip of the iceberg. Vishing (calling a person to get them to surrender their MFA code) has been part of their toolkit because the starting, with the early assaults on Twilio, LastPass, Riot Video games, and Coinbase involving some type of voice-based social engineering.
Notably, the high-profile assaults on Caesars, MGM Resorts, and Transport for London all concerned calling a assist desk to reset credentials because the preliminary entry vector.
- Caesars in August 2023 the place hackers impersonated an IT person and satisfied an outsourced assist desk to reset credentials, after which the attacker stole the client loyalty program database and secured a $15m ransom fee.
- MGM Resorts in September 2023, the place the hacker used LinkedIn data to impersonate an worker and reset the worker’s credentials, leading to a 6TB information theft. After MGM refused to pay, the assault ultimately resulted in a 36-hour outage, a $100m hit, and a class-action lawsuit settled for $45m.
- Transport for London in September 2024 resulted in 5,000 customers’ financial institution particulars being uncovered, 30,000 workers required to attend in-person appointments to confirm their identities and reset passwords, and important disruption to on-line companies lasting for months.
So not solely have Scattered Spider (and different menace teams) been utilizing these methods for a while, however the severity and influence of those assaults have been ramping up.
Avoiding assist desk gotchas
There’s a lot of recommendation for securing assist desks being circulated, however a lot of the recommendation nonetheless ends in a course of that’s both phishable or tough to implement.
In the end, organizations should be ready to introduce friction to their assist desk course of and both delay or deny requests in conditions the place there’s important danger. So, for instance, having a course of for MFA reset that acknowledges the chance related to resetting a high-privileged account:
- Require multi-party approval/escalation for admin-level account resets
- Require in-person verification if the method cannot be adopted remotely
- Freeze self-service resets when suspicious conduct is encountered (this could require some form of inside course of and consciousness coaching to boost the alarm if an assault is suspected)
And be careful for these gotchas:
- If you happen to obtain a name, good follow is to terminate the decision and dial the quantity on file for the worker. However, in a world of SIM swapping, this is not a foolproof resolution — you may simply be re-dialing the attacker.
- In case your resolution is to get the worker on digital camera, more and more refined deepfakes can thwart this method.
However, assist desks are a goal for a cause. They’re “useful” by nature. That is normally mirrored in how they’re operated and efficiency measured — delays will not show you how to to hit these SLAs! In the end, a course of solely works if workers are keen to stick to it — and cannot be socially engineered to interrupt it. Assist desks which might be faraway from day-to-day operations (particularly when outsourced or offshored) are additionally inherently inclined to assaults the place workers are impersonated.
However, the assaults we’re experiencing in the meanwhile ought to give safety stakeholders loads of ammunition as to why assist desk reforms are very important to securing the enterprise (and what can occur in case you do not make adjustments).
Evaluating assist desk scams with different approaches
Taking a step again, it is value serious about how assist desk scams match into the broader toolkit of techniques, methods and procedures (TTPs) utilized by menace actors like Scattered Spider.
Scattered Spider has closely relied on identity-based TTPs since they first emerged in 2022, following a repeatable path of bypassing MFA, reaching account takeover on privileged accounts, stealing information from cloud companies, and deploying ransomware (principally to VMware environments).
- Credential phishing by way of e-mail and SMS (smishing) to reap passwords en masse
- Utilizing SIM swapping (the place you get the service to switch a quantity to your attacker-controlled SIM card) to bypass SMS-based MFA
- Utilizing MFA fatigue (aka. push bombing) to bypass app-based push authentication
- Utilizing vishing (i.e. straight calling a sufferer to social engineer their MFA code, versus a assist desk assault)
- Social engineering area registrars to take management of the goal group’s DNS, hijacking their MX information and inbound mail, and utilizing this to take over the corporate’s enterprise app environments
- And latterly, utilizing MFA-bypass AiTM phishing kits like Evilginx to steal reside person periods, bypassing all widespread types of MFA (apart from WebAuthn/FIDO2)
 |
| Scattered Spider phishing pages working Evilginx. Supply: Researchers at SilentPush |
So, assist desk scams are an necessary a part of their toolkit, but it surely’s not the entire image. Strategies like AiTM specifically have spiked in recognition this yr as a dependable and scalable manner of bypassing MFA and reaching account takeover, with attackers utilizing these toolkits because the de facto customary, getting artistic of their detection evasion strategies and in some circumstances, evading customary supply vectors like e-mail altogether to make sure the success of their phishing campaigns.
Scattered Spider are consciously evading established safety controls
So, there’s extra to Scattered Spider’s toolkit than simply assist desk scams. In actual fact, their method might be broadly categorized as consciously evading established controls on the endpoint and community layer by focusing on identities.
From the purpose of account takeover, additionally they comply with repeatable patterns:
- Harvesting and exfiltrating information from cloud and SaaS companies, the place monitoring is often much less constant than conventional on-premise environments, and exfiltration typically blends in with regular exercise. Many organizations merely haven’t got the logs or visibility to detect malicious exercise within the cloud anyway, and Scattered Spider have additionally been seen tampering with cloud logs (e.g. filtering dangerous AWS CloudTrail logs, however not disabling it totally in order to not increase suspicion).
- Focusing on VMware environments for ransomware deployment. They do that by including their compromised person account to the VMware admins group in VCentre (if wanted — they’re going after accounts with high tier privileges by default). From right here, they’ll entry the VMware surroundings by way of the ESXi hypervisor layer, the place safety software program is nonexistent — thereby bypassing EDR and different typical endpoint and host primarily based controls you depend on to stop ransomware execution.
The important thing theme? Getting round your established safety controls.
Conclusion
You possibly can consider Scattered Spider as a form of “post-MFA” menace actor that does all the pieces they’ll to evade established safety controls. By focusing on identities and account takeovers, they bypass endpoint and community surfaces as a lot as attainable, till the very finish of the assault chain — by which level it is virtually too late to be counting on these controls.
So, do not over-index on assist desk scams — it’s essential contemplate your broader identification assault floor and numerous intrusion strategies, from apps and accounts with MFA gaps, native accounts giving attackers a backdoor into accounts in any other case accessed with SSO, and MFA-bypassing AiTM phishing kits which might be the brand new regular for phishing assaults.
Defend your group from Scattered Spider TTPs (not simply assist desk scams)
To be taught extra about Scattered Spider’s identity-first toolkit, which is more and more being adopted as customary by menace teams, try the newest webinar from Push Safety — now obtainable on-demand!
Find out how Push Safety stops identification assaults
Push Safety gives complete identification assault detection and response capabilities in opposition to methods like AiTM phishing, credential stuffing, password spraying and session hijacking utilizing stolen session tokens. You may also use Push to seek out and repair identification vulnerabilities throughout each app that your workers use, like: ghost logins; SSO protection gaps; MFA gaps; weak, breached and reused passwords; dangerous OAuth integrations; and extra.
If you wish to be taught extra about how Push helps you detect and defeat widespread identification assault methods, e book a while with considered one of our group for a reside demo.
