• Scattered Spider, US crit

    From Mike Powell@1:2320/105 to All on Mon Jul 28 15:25:44 2025
    Scattered Spider hackers are targeting US critical infrastructure via VMware attacks

    Date:
    Mon, 28 Jul 2025 14:28:00 +0000

    Description:
    Scattered Spider has reportedly perfected social engineering, getting privileged access in hours.

    FULL STORY

    The infamous ScatteredSpider ransomware group is using VMware instances to target critical infrastructure organizations in the US, researchers have warned.

    Security researchers from Google Threat Intelligence Group (GITG) have found the criminals are targeting critical infrastructure firms, but also retail, airline, and insurance industries.

    The campaign is described as sophisticated and aggressive, split into
    multiple phases that last no longer than a couple of hours, the experts warn.

    On the hunt for vCSA

    In the campaign, the hackers do not exploit any vulnerabilities, but instead
    go for aggressive, creative, and particularly skilled social engineering.
    They first reach out to their victims IT desk, impersonating an employee, and asking for a reset on the employees Active Directory account.

    After gaining the initial foothold, they would scan the network to identify high-value targets, such as domain names, VMware vSphere admins, and other security departments that can grant them admin access into the virtual environment.

    Then, they would reach out to IT again, this time posing as a more privileged user, again asking for a password reset - but for an account with higher privileges.

    From there, they look to access the VMware vCenter Server Appliance (vCSA), a preconfigured Linux-based virtual machine that provides centralized
    management for VMware vSphere environments, including the ESXi hypervisor.

    This, in turn, allows them to enable SSH connections on ESXi hosts, resetting root passwords.

    From this point on, it is all about identifying and exfiltrating sensitive information, in preparation for the deployment of an encryptor. Locking down the entire network is the final stage of the attack, after which the victims are pressured into paying a ransom demand.

    GTIG says that the entire attack happens quickly, going from initial access
    to ransomware deployment in mere hours, warning companies to tighten up on their security across the board, and to use phishing-resistant MFA.

    Via BleepingComputer

    ======================================================================
    Link to news story: https://www.techradar.com/pro/security/scattered-spider-hackers-are-targeting- us-critical-infrastructure-via-vmware-attacks

    $$
    --- SBBSecho 3.28-Linux
    * Origin: capitolcityonline.net * Telnet/SSH:2022/HTTP (1:2320/105)