By Zeba Siddiqui
San Francisco, Nov 16 (Reuters) –
The FBI has warned organizations to be wary of the Scattered Spider hacking group, which broke into dozens of US organizations last year and stole their sensitive data for extortion.
The FBI alert follows a Reuters report this week that said the agency has struggled to stop these hackers, who are skilled at using fake profiles and impersonations to gain access to a victim organization’s help desk. Are considered.
Security researchers say they were behind the September hacks at casino companies MGM Resorts International and Caesars Entertainment, but they have infiltrated a variety of organizations from telecom companies to healthcare groups.
The statement, issued jointly with the US Cybersecurity and Infrastructure Security Agency, sheds new light on how these hackers work.
The statement said that even after gaining access to an organization’s systems, hackers continue to probe its internal communication channels online such as Slack, Microsoft Teams and Microsoft Exchange for emails or conversations that may have been breached. Has been detected or not.
It says, “Criminals frequently engage in incident prevention and response calls and teleconferences, are likely to recognize how security teams are preying on them and actively develop new avenues of infiltration in response to victim security.” We do.”
The FBI and CISA urged critical infrastructure organizations to implement a series of security measures they recommended and urged victim organizations to share information about the hack with the agencies.
Everything from sample ransom notes to communications with hackers, their cryptocurrency wallet information or samples of malicious files could be useful, he said.
“The FBI and CISA do not encourage ransom payments because payment does not guarantee that a victim’s files will be recovered,” he said. He said ransom payments could encourage hackers to pursue more targets. (Reporting by Zeba Siddiqui in San Francisco; Editing by Nick Zieminski)
Source
