1.800.561.4007 info@ironspear.ca

From Allianz to MGM: What Scattered Spider Teaches Us About Modern Cyber Risks

Cybersecurity headlines are everywhere – and one of the most troubling is the tale of Scattered Spider. Known by multiple names including Octo Tempest, Scattered Swine and UNC3944, Scattered Spider has been behind several recent high-profile attacks, including one that targeted Allianz Life’s Salesforce environment, which the insurer admitted exposed the “majority” of its 1.4 million customer’s records.

There have been recent reports that they are now aligned with ShinyHunters, another high profile threat actor that has been active since 2020. This alliance is driving a lot of the recent media attention, as their combined tactics have been tied to some of the largest SaaS-focused breaches in recent months.

MGM Casino Breach

In 2023, Scattered Spider claimed responsibility for the MGM Resorts cyber attack, which disrupted operations across casinos and hotels. The attackers reportedly gained access in just 10 minutes by impersonating an employee over the phone and tricking the IT help desk into resetting credentials. This breach cost MGM an estimated $100 million and highlighted just how effective social engineering can be when targeting critical businesses.

Instead of relying sophisticated tools, Scattered Spider focuses on the most vulnerable point of entry: people.

 

 Common Tools and Techniques:

  • Open-Source Intelligence Gathering – They are known for gathering information about their target from social media and other publicly available sources.
  • Impersonation & Phone Attacks – Using the information they gather, they target IT help desks, impersonating employees and requesting password resets.
  • Phishing & SMS Scams – They are known to target cellular carriers in an attempt to transfer control of a victim’s phone to their control. They are then able to circumvent SMS-based MFA to gain system access.
  • Push Fatigue – They bombard employees with Multi-Factor Authentication (MFA) login approval requests until someone finally clicks “approve.”
  • Living Off the Land – They are able to evade detection once on the network by leveraging tools natively available on the device (so-called “Living off the Land” attacks). By using existing tools for their attacks instead of introducing new ones, they are able to retain access longer and avoid detection.
  • Leveraging Cloud Tools – Once inside, they typically target SaaS services like Salesforce or Okta – systems that are known to host an organization’s “Crown Jewels”.

Why It Matters for Everyone

Think of it like this: cyber resilience is your ability to take a hit – and keep going.

It’s not just about stopping an attack (though that’s part of it). It’s about how prepared you are to:

  • Detect the problem early
  • Respond quickly and effectively
  • Keep critical functions running
  • Recover your systems and data
  • Communicate clearly throughout

And doing all that without total panic.

Why It Matters to You

  • Nearly 70% of data breaches involve human error or deception, according to Verizon’s 2024 DBIR.
  • The FBI reports $16.6 billion in cybercrime losses last year – phishing and BEC (Business Email Compromise) are major contributors.
  • Scattered Spider’s methods prove that the speed of compromise can be measured in minutes, not days or weeks.

The tools and techniques employed by Scattered Spider aren’t new, but they should be a wake-up call for most organizations – Social Engineering continues to be an effective vector for system compromise.

What You Can Do Now

  • Application controls: Implement application controls to prevent the installation and execution of unauthorised tools including remote access software.
  • Strengthen help desk processes: Ensure your help desk has strong processes in place to confirm a user’s identity before performing password resets.
  • Adopt phishing-resistant MFA: Adopt strong MFA authentication schemes that are resistant to phishing and not susceptible to push bombing or SIM swap attacks.
  • Test your team: Conduct regular phishing tests to simulate these kinds of attacks to identify awareness gaps and process deficiencies.

The Bottom Line

Scattered Spider’s methods show that most breaches don’t come from fancy exploits or sophisticated attacks – they leverage the most prevalent of all system weaknesses – human trust.

 Iron Spear helps organizations shore up defences against modern cyber threats like these. If your team wants to reduce risk and build resilience, we can support your efforts.

  www.ironspear.ca

It’s not just good practice—it’s a competitive edge.

At Iron Spear, we believe resilience is a shared responsibility across leadership, tech teams, and every employee who touches a digital system.

And we’re here to help organisations turn that belief into action.

References