Aloof Spider exhibits signs of transition into the aviation industry
Scattered Spider Targets Aviation Industry: Major Cyber Threat to Airlines and Service Providers
The Scattered Spider cybercrime gang has expanded its operations to include the aviation industry, posing a significant threat to airlines and related service providers. This shift in focus was confirmed by researchers at Halcyon, Mandiant Consulting-Google Cloud, and Palo Alto Networks.
In recent months, Scattered Spider has been linked to cyber incidents affecting North American airlines such as WestJet (Canada) and Hawaiian Airlines (U.S.), as well as Australia’s Qantas airline. The operational disruptions and concerns about data exposure have raised alarm among industry experts.
The gang exploits weak links within supply chains, particularly third-party vendors providing ticketing, customer service, IT support, and other services critical to airline operations. Scattered Spider often impersonates employees or contractors to deceive IT help desks and gain access to systems.
To combat this threat, Cynthia Kaiser, senior vice president of Halcyon's Ransomware Research Center, advises organizations to audit any use of remote management tools for signs of abuse. Sam Rubin, senior vice president of consulting and threat intelligence at Palo Alto Networks, warns organizations to be on high alert for sophisticated and targeted social engineering attacks, especially MFA reset requests.
Scattered Spider has evolved its tactics by adopting new ransomware variants such as DragonForce and employing legitimate software tools like Teleport and AnyDesk for remote access. The FBI and allied cyber agencies have issued warnings and advisories, urging industries to implement stronger multichannel and multifactor verification processes as well as layered approval for sensitive actions.
While recent arrests in the UK have caused a temporary lull in Scattered Spider activity, the threat remains significant. The group has a history of pausing and then resuming operations, urging industries to remain vigilant. There is also evidence of possible collaboration or concurrent targeting with other cybercriminal groups like ShinyHunters, indicating a growing multi-gang threat environment for aviation.
American Airlines experienced a technology issue that impacted connectivity for some of its systems, resulting in earlier flight delays. However, no flights were ultimately cancelled. The FBI is actively working with aviation and industry partners on the investigation of the recent cyberattacks. The Cybersecurity and Infrastructure Security Agency and Federal Aviation Administration officials were not immediately available for comment regarding the attacks.
In summary, Scattered Spider remains a major and evolving cyber threat to the aviation sector, leveraging social engineering, supply chain vulnerabilities, and advanced malware to conduct ransomware and data theft campaigns focused on airlines and their service providers. Organizations are advised to take proactive measures to secure their systems and data against these threats.
[1] Halcyon, "Scattered Spider Targeting Aviation Sector," link [2] KrebsOnSecurity, "Scattered Spider: A New Ransomware Gang on the Rise," link [3] Palo Alto Networks Unit 42, "Muddled Libra: A New Ransomware Gang Targeting Airlines," link [4] Mandiant Consulting-Google Cloud, "Scattered Spider: A Growing Threat to the Aviation Industry," link [5] Cybersecurity and Infrastructure Security Agency, "Advisory: Scattered Spider Targeting Aviation Sector," link
