Scattered Spider, the prolific, sophisticated cyber gang, appears to have hundreds of phishing domains in apparent preparation for future attacks.

The ransomware group which relies on social engineering and phishing techniques to target industries – most recently retail and aviation – does apparently have some tell tale signs in their phishing domains.

In their investigations, researchers at Check Point discovered about 500 domains that follow the known naming conventions of Scattered Spider.

While some appear to target specific industries like retain, tech, and aviation companies, other domains appear to impersonate companies across a wide range of industries, from enterprise, finance, medical technology, manufacturing, and even restaurant chains.

Checkpoint shared examples such as:

• chipotle-sso[.]com
• gemini-servicedesk[.]com
• hubspot-okta[.]com

These demonstrate not only the style of Scattered Spider’s phishing domains, but the range of industries it is prepared to target, highlighting the opportunistic nature of the gang.

Though Check Point could not confirm if all the identified domains were actively malicious, their relation to known tactics, techniques, and procedures (TTPs) suggests that they are intended for future targeting.

The domains provided needed context for firms trying to stay ahead of the elusive and active cyber gang as it shifts its focus from retail to aviation.

Scattered Spider allegedly rattled the retail industry earlier this year, targeting M&S and Co-op in a string of attacks that left the online operations of M&S disrupted for weeks.

More recently, Scattered Spider has been linked to a number of cyber-attacks on airlines, including Hawaiian Airlines and Australian firm Qantas.

Recommended reading

• Is the Qantas Data Breach the Latest Scattered Spider Hit?
• How Scattered Spider’s Web Brought UK Retail to its Knees
• FBI and Google Mandiant Point to Scattered Spider Over Airline Cyber-attacks
• Google Warns US Retailers Could Be Next Following UK Cyber-attacks

The group most typically employs social engineering techniques ranging from MFA manipulation to voice spoofing, SIM swapping, and SMS impersonation.

Scattered Spider has been active since at least 2022, and often uses remote access tools and malware for its intrusion efforts.

Check Point reported that Scattered Spider employs a range of remote access tools like Fleetdeck.io, TeamViewer, and ScreenConnect, and also uses BlackCat ransomware-as-a-service.