In 2023, a hacking group known as Scattered Spider or UNC3944 made headlines for its sophisticated cyberattacks on two of the largest casino companies in the United States: Caesars Entertainment and MGM Resorts International.
Marco Cavani
Cybersecurity Analyst
In 2023, a hacking group known as Scattered Spider or UNC3944 made headlines for its sophisticated cyberattacks on two of the largest financial companies operating in the casino and gambling industry in the United States: Caesars Entertainment and MGM Resorts International.
This report delves into the modus operandi of Scattered Spider, their methods, and the implications of their actions, analysing the threat posed by the hacking group for large enterprises operating in the entertainment and the hospitality industry in Australia, the United States, Europe & India.
The report is based primarily on the exploration conducted by the Federal Bureau of Investigation (FBI) and Cybersecurity & Infrastructure Security Agency (CISA) on Scattered Spider activity as far as November 2023.
Country of origin: Undefined
Affiliation: Scattered Spiders shares their tactics and techniques with various cyber criminal groups such as Octo Tempest, Roasted Okctapus and Storm-0875 and they have been working closely with the BlackCat ransomware gang in the 2023 MGM Resorts incident.
Targeted countries: US, Europe, Australia, and India
Targeted Industries: Finance, Healthcare, Technology, Government, Energy, and Retail
(MITRE ATT&CK® – Scattered Spiders, n.d.)
Scattered Spiders are a sophisticated hacking group composed of well-trained, young, and native English speakers (Brewer, 2023).
These cybercriminals possess expertise in several areas, including:
Initially, they specialized in smishing (SMS phishing), SIM swapping, and social engineering attacks. However, they have recently expanded their operations to include data encryption ransomware, further increasing the threat they pose.
Another concerning aspect of Scattered Spiders is their potential for escalation to physical violence. In previous campaigns, they have used life-threatening messages to intimidate their victims purposely to gain targeted credentials.
Additionally, this group has demonstrated a capability for advanced persistent threats (APT), posing significant risks to their targets, which can include high-profile organizations and critical infrastructure (Microsoft Incident Response, Microsoft Threat Intelligence, 2023).
Scattered Spider targets valuable data in cloud enterprise environments through traditional and hybrid attacks. Their ransomware strategy involves:
They are therefore financially motivated.
(Mandiant, 2023)
Mandiant, a cybersecurity entity and subsidiary of Google, has observed a rise in attack frequency and a greater potential for impact among the Scattered Spider and its affiliates in the past few years.
Typically, Scattered Spiders gain initial access to their targets using SMS spear phishing and impersonating the victim administrator.
After obtaining initial access, they perform a SIM swap to bypass Multi-Factor Authentication (MFA), thereby authenticating themselves as legitimate users on the victim environment using the stolen token.
Once granted access, the unauthorized user gains global privileges, enabling information harvesting using Azure diagnostic extensions.
The Scattered Spiders do not rely on traditional malware attacks that use signature files. Instead, they have been observed using Living Off the Land (LOTL) attacks, which are fileless. This means that LOTL attacks do not require the attacker to install any code or scripts within the target system. Instead, the attacker uses tools that are already present in the environment. For example, the hacking group used the Azure diagnostic extension for information-gathering purposes.
Once the adversary manipulates the environment, they might install a remote access tool to create a covert tunnel for entry. This allows them to avoid detection by the endpoint security system and remain unnoticed on the network. Through this hidden access, they can potentially exfiltrate and/or encrypt data, remaining completely covered throughout the process.
Between June 2023 and November 2023, Scattered Spider conducted numerous high-impact attacks targeting large enterprises, with a particular focus on the hospitality, entertainment, and gaming sectors. Their campaign during this period is characterised by:
The FBI and CISA jointly published a Cybersecurity Advisory (CSA) in November 2023 outlining the group’s indicators of compromise (IOCs) and recommended mitigations following the surge in attack activity.
The following table maps Scattered Spider’s known tactics to the MITRE ATT&CK® framework:
| Tactic | Technique ID | Description |
|---|---|---|
| Initial Access | T1566.002 | Phishing: Spearphishing via SMS |
| Initial Access | T1078 | Valid Accounts |
| Initial Access | T1621 | MFA Request Generation (Fatigue) |
| Execution | T1059.001 | PowerShell |
| Execution | T1059.003 | Windows Command Shell |
| Persistence | T1098.001 | Account Manipulation: Additional Cloud Credentials |
| Persistence | T1136 | Create Account |
| Defense Evasion | T1562.001 | Impair Defenses: Disable or Modify Tools |
| Defense Evasion | T1036 | Masquerading |
| Credential Access | T1110 | Brute Force |
| Credential Access | T1606 | Forge Web Credentials |
| Discovery | T1087 | Account Discovery |
| Discovery | T1082 | System Information Discovery |
| Discovery | T1135 | Network Share Discovery |
| Lateral Movement | T1550.001 | Application Access Token |
| Exfiltration | T1567 | Exfiltration Over Web Service |
| Exfiltration | T1041 | Exfiltration Over C2 Channel |
| Impact | T1486 | Data Encrypted for Impact (Ransomware) |
| Impact | T1490 | Inhibit System Recovery |
(FBI & CISA Cybersecurity Advisory, 2023)
Scattered Spider has been observed leveraging both legitimate and malicious tooling to carry out their attacks:
Remote Access & Tunnelling:
Credential Access:
Persistence & Lateral Movement:
BlackCat / ALPHV Ransomware
BlackCat, also known as ALPHV, is a sophisticated ransomware-as-a-service (RaaS) operation. Written in Rust, it is highly customisable and capable of targeting both Windows and Linux environments, including VMware ESXi hypervisors.
Key characteristics:
Scattered Spider acted as an affiliate of the BlackCat RaaS program, deploying the ransomware after establishing persistent access in victim environments.
Scattered Spider has been observed registering typosquatted domains impersonating legitimate corporate identity providers and IT services. Common patterns include:
okta-sso-[company].com – Impersonating Okta SSO portalssso-[company]-helpdesk.com – Fake help desk portals to harvest credentials[company]-it-support.com – Impersonating corporate IT support portals[company]-okta-portal.com – Spoofed authentication pagesThese domains are used to host phishing pages that closely replicate the target company’s internal authentication systems. Employees directed to these pages unknowingly provide their credentials and MFA tokens to the attackers.
This post is a summary of the full Scattered Spider: The Casino Hacks digital report, which includes:
To request the full report, contact me directly:
(FBI & CISA, 2023)
Date of Attack: September 2023
Attack Vector: Social engineering via LinkedIn reconnaissance followed by a telephone call to the MGM IT help desk
Execution:
The attack on MGM Resorts International is widely regarded as one of the most impactful social engineering attacks in recent history. The initial breach required nothing more than a 10-minute phone call.
The attackers identified an MGM employee through LinkedIn and called the MGM IT help desk, impersonating that employee to request a Multi-Factor Authentication reset. The help desk, following standard IT procedures without adequate identity verification, complied. This gave Scattered Spider a foothold in MGM’s Okta environment.
From there, they escalated privileges to Okta super-administrator level, granting access to MGM’s broader IT infrastructure. The attackers then deployed BlackCat/ALPHV ransomware across MGM’s systems, encrypting critical servers and exfiltrating significant volumes of customer data.
Impact:
MGM’s Response: MGM Resorts International chose not to pay the ransom, instead engaging cybersecurity incident response teams to remediate the attack. MGM disclosed the attack publicly and notified affected customers.
Date of Attack: August 2023
Attack Vector: Social engineering targeting a third-party IT support vendor contracted by Caesars Entertainment
Execution:
In the weeks prior to the MGM attack, Scattered Spider successfully breached Caesars Entertainment using a similar social engineering playbook. Rather than targeting Caesars’ internal help desk directly, the attackers targeted an external IT support contractor who had access to Caesars’ systems.
By compromising a third-party vendor, the attackers gained entry to Caesars’ environment, subsequently accessing the company’s loyalty program database. This database contained the personal information of a significant portion of Caesars’ customer base.
Impact:
Caesars’ Response: Caesars Entertainment opted to pay approximately USD $15 million in ransom, reportedly half of the USD $30 million initially demanded. The payment allowed Caesars to obtain assurances that the stolen data would be deleted, though the verifiability of such assurances in ransomware scenarios is inherently limited. Caesars disclosed the breach in an SEC filing in September 2023.
Based on the analysis of Scattered Spider’s tactics and the case studies above, the following recommendations are provided for organisations in the hospitality, entertainment, and critical infrastructure sectors:
1. Implement Phishing-Resistant MFA
Replace SMS-based and voice call MFA with phishing-resistant alternatives such as FIDO2 hardware security keys (e.g., YubiKey) or passkeys. These cannot be intercepted via SIM swapping or real-time phishing.
2. Establish Rigorous Identity Verification for Help Desk Requests
Introduce mandatory callback verification and manager approval workflows for any MFA reset, password change, or privilege escalation request. Help desk staff should never complete these requests based solely on a phone call or unverified identity.
3. Adopt Zero Trust Architecture
Implement a Zero Trust security model that requires continuous verification of all users and devices, regardless of network location. Assume breach and limit the blast radius of any successful intrusion through network micro-segmentation.
4. Monitor for MFA Fatigue Indicators
Deploy tooling to detect and alert on unusual MFA push notification patterns, which are indicative of MFA fatigue attacks. Block accounts automatically after a configurable number of unexpected MFA requests within a short period.
5. Third-Party Vendor Risk Management
Conduct thorough security assessments of all third-party vendors with access to internal systems. Implement least-privilege access controls for vendors and require them to meet your organisation’s security standards.
6. Security Awareness Training
Run targeted security awareness training focused on social engineering recognition for all staff, with particular emphasis on IT help desk personnel, system administrators, and anyone with privileged account management capabilities.
7. Network Segmentation and Least Privilege
Limit lateral movement opportunities by segmenting networks and applying the principle of least privilege to all user and service accounts. High-value systems (e.g., payment processing, loyalty program databases) should be isolated in separate network segments.
8. Incident Response Planning
Develop and regularly test an incident response plan that accounts for ransomware scenarios, including communication protocols, recovery procedures, and decision frameworks for ransom payment decisions.
Brewer, R. (2023). Scattered Spider: Inside the Hacking Group Terrorising US Companies. Wired.
FBI & CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider. Cybersecurity & Infrastructure Security Agency.
Mandiant. (2023). UNC3944: SMS Phishing and SIM Swapping Lead to Cloud Intrusions and Ransomware. Mandiant Threat Intelligence.
Microsoft Incident Response & Microsoft Threat Intelligence. (2023). Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction. Microsoft Security Blog.
MITRE ATT&CK®. (n.d.). Scattered Spider, G1015. MITRE ATT&CK.
MGM Resorts International. (2023). SEC 8-K Filing: Material Cybersecurity Incident.
Caesars Entertainment. (2023). SEC 8-K Filing: Cybersecurity Incident.
Written by
Marco Cavani
Cybersecurity analyst and IT governance professional. Author of digital reports on threat intelligence, critical infrastructure security, and IT audit frameworks.
More than 60 percent of UK universities experienced a ransomware or significant cyberattack between 2019 and 2023. This report examines the structural characteristics that make universities persistent ransomware targets, the ITGC control gaps common across the sector, and the specific cases that illustrate the pattern.
In October 2022, REvil-linked actors exfiltrated the health insurance records of 9.7 million Australians from Medibank Private. When the company refused to pay the ransom, the attackers published customers' most sensitive medical data online. This report examines the breach, the control failures, and what happens when health data becomes a coercion instrument.
In September 2022, a social engineering attack targeting a third-party database provider exposed the personal data of 50,150 Revolut customers. This report examines the incident, the ITGC control failures that enabled it, and the systemic risk facing fintech firms that aggregate sensitive customer data at scale.
Get the latest cybersecurity reports, threat intelligence, and IT governance insights delivered straight to your inbox. No spam. Unsubscribe any time.
No spam. Unsubscribe at any time.
The RACM ITGC SaaS platform helps audit professionals manage IT General Controls assessments, from risk and control mapping to workpaper generation and evidence tracking.