Sep 17, 2025Ravie LakshmananThreat Intelligence / Cybercrime
Cybersecurity researchers have tied a recent spherical of cyber assaults focusing on monetary companies to the infamous cybercrime group generally known as Scattered Spider, casting doubt on their claims of going “darkish.”
Risk intelligence agency ReliaQuest mentioned it has noticed indications that the menace actor has shifted their focus to the monetary sector. That is supported by a rise in lookalike domains probably linked to the group which are geared in direction of the business vertical, in addition to a lately recognized focused intrusion towards an unnamed U.S. banking group.
“Scattered Spider gained preliminary entry by socially engineering an government’s account and resetting their password by way of Azure Lively Listing Self-Service Password Administration,” the corporate mentioned.
“From there, they accessed delicate IT and safety paperwork, moved laterally via the Citrix setting and VPN, and compromised VMware ESXi infrastructure to dump credentials and additional infiltrate the community.”
To realize privilege escalation, the attackers reset a Veeam service account password, assigned Azure International Administrator permissions, and relocated digital machines to evade detection. There are additionally indicators that Scattered Spider tried to exfiltrate knowledge from Snowflake, Amazon Net Companies (AWS), and different repositories.
Exit or Smokescreen?
The latest exercise undercuts the group’s claims that they had been ceasing operations alongside 14 different legal teams, comparable to LAPSUS$. Scattered Spider is the moniker assigned to a loose-knit hacking collective that is a part of a broader on-line entity known as The Com.
The group additionally shares a excessive diploma of overlap with different cybercrime crews like ShinyHunters and LAPSUS$, a lot in order that the three clusters fashioned an overarching entity named “scattered LAPSUS$ hunters.”
Certainly one of these clusters, notably ShinyHunters, has additionally engaged in extortion efforts after exfiltrating delicate knowledge from victims’ Salesforce situations. In these circumstances, the exercise occurred months after the targets had been compromised by one other financially motivated hacking group tracked by Google-owned Mandiant as UNC6040.
The incident is a reminder to not be lulled right into a false sense of safety, ReliaQuest added, urging organizations to remain vigilant towards the menace. As within the case of ransomware teams, there is no such thing as a such factor as retirement, as it’s totally a lot doable for them to regroup or rebrand below a distinct alias sooner or later.
“The latest declare that Scattered Spider is retiring must be taken with a major diploma of skepticism,” Karl Sigler, safety analysis supervisor of SpiderLabs Risk Intelligence at Trustwave, mentioned. “Quite than a real disbanding, this announcement possible indicators a strategic transfer to distance the group from growing regulation enforcement strain.”
Sigler additionally identified that the farewell letter must be seen as a strategic retreat, permitting the group to reassess its practices, refine its tradecraft, and evade ongoing efforts to place a lid on its actions, to not point out complicate attribution efforts by making it tougher to tie future incidents to the identical core actors.
“It is believable that one thing throughout the group’s operational infrastructure has been compromised. Whether or not via a breached system, an uncovered communication channel, or the arrest of lower-tier associates, one thing has possible triggered the group to go darkish, at the very least briefly. Traditionally, when cybercriminal teams face heightened scrutiny or undergo inner disruption, they typically ‘retire’ in title solely, opting as a substitute to pause, regroup, and finally re-emerge below a brand new id.”
