Scattered Spider Tied to Fresh Attacks on Financial Services

DataBreaches[.]Net reports that a member of the group calling itself Scattered Lapsus$ Hunters published a note suggesting they would go dark, though many experts remain skeptical that ScatteredSpider-related activity has ceased. According to ReliaQuest, indicators of compromise tied to Scattered Spider are still observable, and a U.S. banking organisation—which was not named—was targeted in what ReliaQuest described as a technically sophisticated attack that followed a retirement announcement.

The attacker allegedly sought to exfiltrate data from multiple repositories, including the victim’s Amazon Web Services accounts and a cloud-based data platform Snowflake. ReliaQuest stated that Scattered Spider gained initial access by socially engineering an executive’s account and resetting its password via Azure Active Directory Self-Service Password Management, then moved laterally through the Citrix environment and VPN and compromised VMware ESXi infrastructure to dump credentials and deepen infiltration.

Read more at Bank InfoSecurity, and note that experts cited by the piece continue to question whether ShinyHunters, LAPSUS$, and Scattered Spider would truly retire.