Microsoft: Scattered Spider Widens Web With RansomHub & Qilin
The gang already uses varied tools in its attacks, such as phishing, SIM swapping, and MFA fatigue.
July 16, 2024
![A spiderweb covered in rain droplets in front of blurred greenery A spiderweb covered in rain droplets in front of blurred greenery](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt7081b82bcde235c8/6696e1b6be539902303efea1/spiderweb(1800)_Stephen_Street_alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Octo Tempest, a threat actor also known as Scattered Spider, has added RansomHub and Qilin to its repository for use in attacks, Microsoft's Threat Intelligence Team is warning.
The gang, which first arrived on the scene in 2022, is known for its social engineering techniques, which Microsoft describes as sophisticated, as well as identity compromises, targeting of VMware ESXi servers, and deployment of BlackCat ransomware. It was also infamously behind the massive ransomware attacks on Caesars Palace and MGM Entertainment last year.
Other tactics, techniques, and procedures (TTPs) the group is known to use include impersonating IT employees to deceive company staff into providing credentials or gaining persistence using remote access tools, as well as phishing, MFA bombing, and SIM swapping.
Qilin ransomware also surfaced in 2022 under a different name, "Agenda," but quickly rebranded. The group is known to have targeted and claimed more than 130 companies, demanding ransoms from as low as $25,000 and well into millions, and is developing a customizable Linux encryptor to target VMware ESXi servers, according to Microsoft. RansomHub, meanwhile, is a ransomware-as-a-service (RaaS) offering that is becoming increasingly favored by threat actors, "making it one of the most widespread ransomware families today," the tech giant said via X.
Octo Tempest accounts for a significant number of the investigations that the Microsoft team covers, it said, and has dominated incident response engagements it has received since first gaining attention through its "oktapus" campaign, which targeted over 130 well-known organizations.
About the Author
You May Also Like
Securing Your Cloud Assets
August 27, 2024Determining Exposure and Risk In The Event of a Breach
August 28, 2024Developing a Cyber Risk Assessment for the C-Suite
August 29, 2024Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024