Scattered Spider uses help-desk calls to bypass MFA
Original title: Scattered Spider Hackers Exploit Help Desk Calls to Bypass MFA and Breach Corporate Networks
Flare says a help-desk call alone does not prove the group, and CISA urges phishing-resistant MFA.
Flare describes Scattered Spider, also known as UNC3944 and Octo Tempest, persuading help desks to reset passwords or move MFA to attacker-controlled devices. Callers use public and stolen personal details, then may reach email, SSO, VPN and cloud services. The same reporting covers MFA fatigue and SIM swaps. Access can lead to privilege escalation, data theft, extortion or ransomware, but a reset does not by itself compromise a whole network.
Unconfirmed: Flare says help-desk vishing alone does not prove Scattered Spider carried out an incident.
- Flare researcher Jon DiMaggio says attribution needs evidence beyond one call.
- CISA recommends FIDO/WebAuthn or public-key MFA.
- High-risk resets should use a trusted second channel or manager approval.
- Flare names RattyRAT; the item lists no file hashes or network indicators.
Impact: Account takeover via help-desk password or MFA resets
- 1.Use phishing-resistant MFA such as FIDO/WebAuthn or public-key methods.
- 2.Verify identity on a trusted channel before password or MFA changes.
- 3.Alert on unusual MFA registrations, repeated prompts and unfamiliar logins after recovery.
- ATT&CK
- T1566.004 Spearphishing VoiceT1621 Multi-Factor Authentication Request GenerationT1098 Account Manipulation
- Threat actors
- Scattered SpiderUNC3944Octo Tempest
- Malware
- RattyRAT
From the original article
5 min read at cybersecuritynews.com
A convincing phone call can be enough to open a path into a company network. Scattered Spider has repeatedly used social engineering to persuade help desk workers to reset passwords or move multi-factor authentication (MFA) to a device controlled by an attacker. Instead of breaking the security technology directly, the caller exploits the support process […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.