Scattered Spider appears to have turned its fangs to the aviation sector, as multiple airlines report data breaches, as security experts at Google Mandiant and the FBI point their fingers at the infamous cyber gang.

Scattered Spider made headlines for its prolific attacks against UK retail giants, M&S, Co Op, and Harrods, but now appears to be targeting airlines.

Research from Google Cloud Mandiant suggested that the multiple incidents targeting the airline and transportation sector “resemble the operations of UNC3944 or Scattered Spider,” Charles Carmakal, CTO and board adviser or Google Cloud Mandiant wrote on LinkedIn.

In close conjunction with the report warning and report from Mandiant, the US Federal Bureau of Investigation (FBI) said that it “has recently observed the cyber-criminal group Scatted Spider expanding its targeting to include the airline sector,” in a LinkedIn post from 27 June.

The warnings and report comes after several reports of cyber incidents targeting airline companies operating in North America. This includes WestJet Airlines, a Canadian company that responded to a cyber incident on 13 June, and Hawaiian Airlines, that said on 26 June its IT systems had been affected by a cyber event.

Despite these incidents, flight operations were not affected.

It remains uncertain if ransomware was involved in the incidents, or if the incidents are actually linked to Scattered Spider.

Recommended reading

• How Scattered Spider’s Web Brought UK Retail to its Knees
• Google Warns US Retailers Could Be Next Following UK Cyber-attacks
• Cyber-attacks A “Wake-up Call” to Retail Sector

The initial linkage to Scattered Spider is not surprising however, as the cyber-gang often targets whole industries at the same time, hence their recent tirade against UK retailers.

The cyber group has been known to be made up of mostly young, native English speakers, relying on social engineering tactics to infiltrate systems.

Both the FBI and Google Cloud Mandiant issued warnings to all organisations, even those outside of targeted industries, to be mindful of social engineering tactics. This was especially emphasised when it comes to IT help desks, where Scattered Spider has been known to attempt breaches or steal credentials.

The FBI also warned that trusted vendors and third parties are also at risk from attacks aimed at the airline industry. ss