Who Is Scattered Spider?
Scattered Spider (UNC3944, Starfraud, Muddled Libra) is a financially motivated threat group consisting primarily of English-speaking individuals, many in their teens and early 20s. Despite their youth, they've compromised MGM Resorts, Caesars Entertainment, Twilio, Cloudflare, and dozens of other Fortune 500 companies.
Their Techniques
1. Help Desk Social Engineering
Attackers call IT help desks impersonating employees, providing real employee information (scraped from LinkedIn, breached HR data) and requesting:
- Password resets
- MFA device enrollment
- Account unlocks
2. SIM Swapping
Attackers bribe or social-engineer mobile carrier employees to transfer victim phone numbers to attacker-controlled SIMs, bypassing SMS-based MFA.
How to Stop It: Migrate from SMS MFA to FIDO2/hardware tokens or authenticator apps. SMS MFA is better than nothing but vulnerable to SIM swap.3. MFA Fatigue (Push Bombing)
Flood victim's phone with MFA push requests hoping they approve accidentally or out of frustration.
How to Stop It: Enable number matching in Microsoft Authenticator/Okta. Require additional context. Alert on more than 3 denied MFA pushes.4. Phishing Kits with Real-Time Relay
Proxy phishing sites (Evilginx2, Modlishka) that relay credentials and session cookies in real-time, capturing sessions even after MFA completion.
How to Stop It: Phishing-resistant MFA (FIDO2) is the only defense. Certificate-based auth, passkeys, or hardware tokens.Help Desk Hardening Checklist
- [ ] Never reset MFA via phone — require ticket with manager approval
- [ ] Implement callback verification using HR system phone numbers
- [ ] Log and alert on all MFA device enrollment events
- [ ] Require video verification for high-privilege account changes
- [ ] Train help desk staff quarterly with social engineering simulations