The FBI has put the aviation world on notice: Scattered Spider, the same crew that paralyzed casinos last year, is now infiltrating airline networks by fooling help-desk agents into approving fraudulent multi-factor-authentication changes. 

How the intrusions unfold

• Attackers pose as pilots, contractors, or managed-service staff and phone support desks with urgent requests. 

• Help-desk staff are convinced to add new phones or tokens, handing the intruders live access to cloud and on-prem systems.

• With valid credentials the group pivots into Azure Entra ID, Horizon VDI, VPNs, and vCenter, then steals data for extortion or detonates ransomware when cornered. 

Scale of the threat
Google Mandiant and Palo Alto Networks confirm multiple airline and transportation breaches that mirror Scattered Spider tactics, including recent incidents at Hawaiian Airlines and WestJet. 

Inside a recent breach
ReliaQuest describes the gang impersonating a chief financial officer, passing identity checks with real birth date and partial SSN, then battling defenders for global-admin control before wiping firewall rules in a last-ditch scorched-earth move. 

The bottom line
Scattered Spider wins by hijacking moments of human trust, not by brute-forcing code. Strengthen identity checks at the help desk, keep watch for suspicious MFA resets, and move fast when alerts fire. Find breaches, hunt threats, defend the skies.

Get HEROIC Guardian now! Stay ahead of cyber threats with real-time breach monitoring. Guardian scans the dark web to identify when your data has been leaked, providing instant details about the exposure. From compromised passwords to sensitive information, our platform empowers you to act swiftly and mitigate risks before they escalate.

Click here to learn more: https://heroic.com/products/guardian/