Scattered Spider Resurfaces With Financial Sector Attacks Despite Retirement Claims

Cybersecurity researchers have tied a fresh round of attacks on the financial sector to the Scattered Spider group, casting doubt on their retirement claims. According to ReliaQuest, there are indications the threat actor has shifted focus to financial services, supported by lookalike domains linked to the sector and a recently identified intrusion against an unnamed US banking organisation.

The group reportedly gained initial access by socially engineering an executive’s account and resetting their password via Azure Active Directory Self-Service Password Management. From there, they accessed sensitive IT and security documents, moved laterally through the Citrix environment and VPN, and compromised VMware ESXi infrastructure to dump credentials and infiltrate the network.

To escalate privileges, the attackers reset a Veeam service account password and granted Azure Global Administrator permissions, with signs they attempted to exfiltrate data from Snowflake, AWS and other repositories. The commentary includes a sceptical view from Trustwave’s Karl Sigler, who said the farewell letter should be seen as a strategic retreat rather than a true disbanding.