Scattered Spider Hackers Target Insurance Firms In A Vicious Ransomware Web

A few months ago, a group of cybercriminals, Scattered Spider, launched sophisticated cyber attacks that bypassed key security infrastructures of several retail companies in the UK. The group has become even more notorious and has reportedly launched a new wave of attacks targeting insurance companies in the United States.

The first company to be hit in this wave of Spider attacks in the UK was Marks and Spencer back in February of this year. In the attack, the gang exploited a vulnerability caused by a vendor's employee error. This error allowed the gang to impersonate key personnel and disable the multiple-factor authentication( MFA) shield protecting IT systems. The gang is reputable for deploying social engineering tactics to lure employees and security personnel into taking actions that will compromise their security infrastructures.

Google threat intelligence researcher John Hultquist has observed the same mode of attacks reported in the UK sweeping across insurance companies in the US. The security expert explained that recent attacks "bear all the hallmarks of Scattered Spider activity."

In the early stages of their attacks, the gang is infamous for circumventing MFAs, hijacking phone calls, and using phishing attacks to harvest credentials. In later stages, they exfiltrate data and deploy ransomware to extort victims financially. The gang was dubbed Scattered Spider for its ability to deploy complex web-like social engineering attacks on victims. In what appears to be a confirmation of the gang's actions, two insurance companies, Philadelphia Insurance Companies (PHLY) and Erie Insurance, have both reported incidents of cyber attacks this month.


It's interesting to note that popular ransomware gangs such as Clop and WannaCry are affiliated to Russia and North Korea respectively, the Scattered Spider gang appears to be different. Security researchers reported that this gang comprised of native English speakers, most likely from the US and the UK. This might account for why the gang could easily impersonate English customer care representatives and write flawless English.

Therefore, based on the gang's heavy dependence on social engineering tactics, companies are encouraged to educate employees on these techniques. In addition, strengthening the password reset system and MFA was also recommended. Further information can also be found in Bleeping Computer's report about this gang.