Posts

, , , , , , ,

Scattered Spider

Scattered Spider: Impersonation, and Cybersecurity in the Age of Cloud Computing

By Skeeter Wesinger
June 29, 2025

In an era where companies have moved their infrastructure to the cloud and outsourced much of their IT, one old-fashioned tactic still defeats the most modern defenses: impersonation.
At the center of this threat is Scattered Spider, a cybercriminal collective that doesn’t exploit code—they exploit people. Their operations are quiet, persuasive, and dangerously effective. Instead of smashing through firewalls, they impersonate trusted employees—often convincingly enough to fool help desks, bypass multi-factor authentication, and gain access to critical systems without ever tripping an alarm.
This is the cybersecurity challenge of our time. Not ransomware. Not zero-days. But trust itself.
Who Is Scattered Spider?
Known to threat intelligence teams as UNC3944, Muddled Libra, or 0ktapus, Scattered Spider is an English-speaking group that has compromised some of the most security-aware companies in North America. Their breaches at MGM Resorts and Caesars Entertainment made headlines—not because they used sophisticated malware, but because they didn’t have to.
Their weapon of choice is the phone call. A help desk technician receives a request from someone claiming to be a senior executive who lost their device. The impersonator is articulate, knowledgeable, and urgent. They know internal jargon. They cite real names. Sometimes, they even use AI-generated voices.
And too often, it works. The attacker gets a password reset, reroutes MFA codes, and slips in undetected.
The Illusion of Familiarity
What makes these attackers so dangerous is their ability to sound familiar. They don’t just say the right things—they say them the right way. They mirror internal language. They speak with confidence. They understand hierarchy. They’re skilled impersonators, and they prey on a simple reflex: the desire to help.
In the past, we might have trusted our ears. “It sounded like them,” someone might say.
But in the age of AI, “sounding like them” is no longer proof of identity. It’s a liability.
When Cloud Isn’t the Cure
Many organizations have moved to cloud-based environments under the assumption that centralization and managed services will reduce their exposure. In some ways, they’re right: the cloud simplifies infrastructure and offloads security operations. But here’s the truth: you can’t outsource responsibility. The human layer remains—and that’s precisely where Scattered Spider operates.
They don’t need to breach Azure or AWS. They just need to impersonate someone with access to it.
It’s time we stop treating “trust but verify” as a cliché and start treating it as operational policy. Better yet: trust—but always verify. Every request. Every reset. Every exception.
Verification today means more than checking a box. It requires multi-channel authentication. It means never resetting MFA or passwords based solely on a phone call, no matter how credible the caller seems. It means locking down help desk protocols so impersonation doesn’t slip through the cracks.
Security teams must also monitor legitimate tools—like AnyDesk, TeamViewer, and ScreenConnect—that attackers often use once inside. These aren’t inherently malicious, but in the wrong hands, they’re devastating.
And above all, organizations must train their frontline personnel—especially support staff—to treat every identity request with healthy skepticism. If your instinct says something feels off, pause and verify through secure channels. Escalate. Slow down. Ask the questions attackers hope you won’t.
Scattered Spider doesn’t hack your servers. They hack your systems of trust. They bypass encryption by impersonating authority. And they exploit the one vulnerability no software can patch: assumption.
As we continue shifting toward remote work, outsourced IT, and cloud-based everything, the real threat isn’t technical—it’s personal. It’s the voice on the line. The urgent request. The person who “sounds right.”
In this world, cybersecurity isn’t just about what you build. It’s about what you believe—and what you’re willing to question.
Therefore, you have to train your teams. Harden your protocols. And remember in the age of the cloud, the most important firewall is still human.
Trust—but always verify!

/by
, , ,

In a classic phishing move

In a classic phishing move: spoofing a legit security company like VadeSecure to make the email look trustworthy. Irony at its finest—phishers pretending to be the anti-phishing experts.

Here’s what’s likely going on:

  • vadesecure.com is being spoofed—the return address is faked to show their domain, but the email didn’t actually come from Vade’s servers.

  • Or the phishers are using a lookalike domain (e.g., vadesecure-support.com or vadesecure-mail.com) to trick people not paying close attention.

If you still have the email:

  • You can check the email headers to see the real “from” server (look for Return-Path and Received lines).

  • If the SPF/DKIM/DMARC checks fail in the headers, that’s confirmation it’s spoofed.

  • You can also report it to VadeSecure directly at: abuse@vadesecure.com

By Skeeter Wesinger

March 26, 2025

/by
, , ,

Cybercrime is on the rise

In the first half of 2024, the world witnessed a dramatic escalation in the methods and ambitions of cybercriminals, whose tactics have grown more sophisticated and ruthless with each passing year. No longer content with merely disrupting businesses, these actors turned their attention to critical infrastructure and public services, inflicting damage that rippled through entire economies and societies. The evolution of ransomware, which began as a mere threat of data encryption, now routinely involves what has been termed “double extortion.” In these schemes, criminals not only lock away valuable data but also steal it, holding both the integrity of the files and their potential exposure to the highest bidder, over the heads of their victims.

Whaling

Whaling

The reasons for this relentless onslaught are manifold. In part, it is due to the steady refinement of the tools of cybercrime—particularly the rise of ransomware-as-a-service (RaaS), where the means to carry out attacks are offered, for a price, to anyone with nefarious intent. No longer confined to the realm of expert hackers, these services have democratized cyberattacks, opening the floodgates to both opportunists and ideologues alike. Increasingly, attacks are driven not only by the pursuit of profit but by political or ideological motives, reflecting the charged and fractured state of global affairs.

Data theft has also become a more prominent feature of the digital battlefield. Sensitive personal and corporate information, once stolen, can fetch vast sums on the dark markets, or be used as leverage in extortion schemes that terrify individuals and businesses alike. The impacts of such thefts, already grievous, are compounded by the fear of exposure in an age where privacy has become a luxury few can afford.

A major contributing factor to the unchecked spread of these attacks is the interconnectedness of the modern world. The vulnerability of supply chains, in particular, has been laid bare. A single attack on a supplier can reverberate across industries, causing widespread disruption. Few industries remain untouched as companies rely on third-party providers whose weaknesses are easily exploited by attackers. Thus, an attack on one becomes an attack on all, with consequences magnified by the intricate web of dependencies that define the global economy.

Geopolitical tensions, too, have played a significant role. As states vie for power, the use of cyberattacks as instruments of warfare has increased in frequency and boldness. The world in 2024 is a battlefield, and its most vital infrastructure—financial systems, government agencies, and energy grids—has become the primary target. Particularly dangerous are the state-sponsored campaigns aimed at undermining not only economies but the trust the public places in its institutions. Chaos and disruption, once occasional hazards, have now become central tactics in the arsenal of cyber warfare.

Compounding all of this has been the rapid transformation of the workplace. Since the pandemic, the adoption of remote work and cloud technologies has left organizations exposed. Their hastily constructed digital environments, meant to provide convenience and adaptability, have proven to be fertile ground for cybercriminals. Attackers, seizing on these vulnerabilities, have exploited them with devastating success, leaving no corner of the digital world unscathed.

Whereas in previous years, cyberattacks were often contained and managed without much public notice, 2024 has shattered that illusion. The impacts are now visible and painful, disrupting the very services—healthcare, energy, communication—on which society depends. The scale and visibility of the attacks have eroded the sense of security that once prevailed, leaving the public with the unmistakable feeling that the storm is far from over.

By Skeeter Wesinger

October 14, 2024

https://www.linkedin.com/pulse/cybercrime-rise-skeeter-wesinger-wyl4e

/by