The Rise and Fall of the “Scattered Spider” Hackers.

After greater than two years of evading capture following a hacking spree that targeted some of the world’s largest technology firms, U.S. authorities say they’ve finally caught a minimum of some of the hackers responsible.

In August 2022 security researchers made their information public with a warning that a bunch of hackers targeted greater than 130 organizations in a complicated phishing campaign that stole the credentials of nearly 10,000 employees. The hackers specifically targeted firms that use Okta, a single sign-on service provider that hundreds of firms around the world use to permit their employees to log in from home.

Due to its give attention to Okta, the hacker group was dubbed “0ktapus”. By now the group has been hacked Caesar’s entertainmentCoinbase, DoorDash, Mailchimp, Riot Games, Twilio (twice) and dozens more.

The most notable and severe cyber attack by hackers in terms of downtime and impact was the September 2023 breach of MGM Resorts, which reportedly cost the casino and hotel giant a minimum of $100 million. In this case, the hackers collaborated with the Russian-speaking ransomware gang ALPHV and demanded a ransom from MGM for the company to get better its files. The break-in was such a nuisance that MGM-owned casinos had problems with service delivery for several days.

Over the past two years, as law enforcement has closed in on hackers, people in the cybersecurity industry have been attempting to work out exactly tips on how to classify hackers and whether to place them in a single group or one other.

Techniques utilized by hackers similar to social engineering, email and SMS phishing, and SIM swapping are common and widespread. Some of the individual hackers were part of several groups chargeable for various data breaches. These circumstances make it obscure exactly who belongs to which group. Cybersecurity giant CrowdStrike has dubbed this hacker group “Scattered Spider,” and researchers imagine it has some overlap with 0ktapus.

The group was so energetic and successful that the US cybersecurity agency CISA and the FBI issued a advice in late 2023 with detailed details about the group’s activities and techniques in an try and help organizations prepare for and defend against anticipated attacks.

Scattered Spider is a “cybercriminal group targeting large companies and their IT helpdesks,” CISA said in its advisory. The agency warned that the group “typically engaged in data theft for extortion purposes” and noted its known ties to ransomware gangs.

One thing that is comparatively certain is that hackers mostly speak English and are generally believed to be teenagers or early 20s, and are sometimes called “advanced, persistent teenagers.”

“A disproportionate number of minors are involved and this is because the group deliberately recruits minors due to the lenient legal environment in which these minors live, and they know that nothing will happen to them if the police catch the child” – Allison Nixon , director of research for Unit 221B, told TechCrunch at the time.

Over the past two years, some members of 0ktapus and Scattered Spider have been linked to a similarly nebulous group of cybercriminals generally known as “Com” People inside this broader cybercriminal community committed crimes that leaked into the real world. Some of them are chargeable for acts of violence similar to robberies, burglaries and bricklaying – hiring thugs to throw bricks at someone’s house or apartment; and swatting – when someone tricks authorities into believing that a violent crime has occurred, prompting the intervention of an armed police unit. Although born as a joke, the swat has fatal consequences.

After two years of hacking, authorities are finally starting to discover and prosecute Scattered Spider members.

in July This was confirmed by the British police arrest of a 17-year-old in reference to the MGM burglary.

In November, the U.S. Department of Justice announced it had indicted five hackers: Ahmed Hossam Eldin Elbadawy, 23, of College Station, Texas; Noah Michael Urban, 20, from Palm Coast, Florida, arrested in January; Evans Onyeaka Osiebo, 20, of Dallas, Texas; Joel Martin Evans, 25, of Jacksonville, North Carolina; and Tyler Robert Buchanan, 22, from the UK, who was arrested in June in Spain.