Prolific cybercriminal group now targeting aviation, transportation companies

Axios

16 hours ago

The notorious Scattered Spider hacking gang is now actively targeting the aviation and transportation sectors, cybersecurity firms warned on Friday.
Why it matters: The group of mostly Western, English-speaking hackers has been on a months-long spree that's prompted operational disruptions at grocery suppliers, major retail storefronts and insurance companies in the U.S. and U.K.
Driving the news: Hawaiian Airlines said Thursday it's addressing a "cybersecurity incident" that affected some of its IT systems.
Canadian airline WestJet faced a similar incident last week that caused outages for some of its systems and mobile app.
A source familiar with the incidents told Axios that Scattered Spider was likely behind the WestJet incident.
Josh Yeats, a WestJet spokesperson, told Axios that the company has made "significant progress" to resolve the incident, but did not answer questions about Scattered Spider's possible involvement.
What they're saying: Charles Carmakal, the chief technology officer at Google's Mandiant Consulting, said in an emailed statement that the company is "aware of multiple incidents in the airline and transportation sector which resemble the operations of UNC3944 or Scattered Spider."
"We are still working on attribution and analysis, but given the habit of this actor to focus on a single sector we suggest that the industry take steps immediately to harden systems," Carmakal said.
Palo Alto Networks also said they saw evidence of these hackers targeting the aviation sector.
"Organizations should be on high alert for sophisticated and targeted social engineering attacks and suspicious MFA reset requests," Sam Rubin, senior vice president of consulting and threat intelligence at Palo Alto Networks' Unit 42, said on LinkedIn.