Scattered Spider hackers are targeting US critical infrastructure via VMware attacks
Scattered Spider criminals have perfected social engineering

- Google warns of ScatteredSpider's advanced social engineering tactics
- The hackers gain privileged access and use it to deploy ransomware
- The group targets critical infrastructure, retail, airline, and other industries
The infamous ScatteredSpider ransomware group is using VMware instances to target critical infrastructure organizations in the US, researchers have warned.
Security researchers from Google Threat Intelligence Group (GITG) have found the criminals are targeting critical infrastructure firms, but also retail, airline, and insurance industries.
The campaign is described as “sophisticated and aggressive”, split into multiple phases that last no longer than a couple of hours, the experts warn.
On the hunt for vCSA
In the campaign, the hackers do not exploit any vulnerabilities, but instead go for “aggressive, creative, and particularly skilled” social engineering. They first reach out to their victim’s IT desk, impersonating an employee, and asking for a reset on the employee’s Active Directory account.
After gaining the initial foothold, they would scan the network to identify high-value targets, such as domain names, VMware vSphere admins, and other security departments that can grant them admin access into the virtual environment.
Then, they would reach out to IT again, this time posing as a more privileged user, again asking for a password reset - but for an account with higher privileges.
From there, they look to access the VMware vCenter Server Appliance (vCSA), a preconfigured Linux-based virtual machine that provides centralized management for VMware vSphere environments, including the ESXi hypervisor.
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
This, in turn, allows them to enable SSH connections on ESXi hosts, resetting root passwords.
From this point on, it is all about identifying and exfiltrating sensitive information, in preparation for the deployment of an encryptor. Locking down the entire network is the final stage of the attack, after which the victims are pressured into paying a ransom demand.
GTIG says that the entire attack happens quickly, going from initial access to ransomware deployment in “mere hours”, warning companies to tighten up on their security across the board, and to use phishing-resistant MFA.
Via BleepingComputer
You might also like
- FBI warns Scattered Spider hackers are now going after airlines
- Take a look at our guide to the best authenticator app
- We've rounded up the best password managers
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
You must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.