Infamous cyberattackers claim their next shocking victim — using a decades-old trick
In 2023, a hacking group called Scattered Spider executed an unprecedented hit on Las Vegas, using a relatively simple yet shockingly effective technique. Now, group members are the prime suspects in another shockingly high-profile cyberattack. The group attacked MGM casinos in 2023, seemingly gaining access after phishing for credentials. In response, the Bellagio, Aria, Cosmopolitan, and Excalibur casinos shut down large parts of their networks after the breach was discovered in an attempt to cordon off the access.The FBI has warned about these scams since 2007."Slot machines stopped working, electronic transfers of winnings slowed down, and key cards for thousands of hotel rooms no longer functioned," Ars Technica wrote at the time.Later that same year, Caesars Entertainment described a social engineering attack that led to data theft from its customer rewards program.An outsourced IT support vendor provided unauthorized access, and the breach wasn't discovered for weeks.Now, that same method, called "vishing," has been used to penetrate another massive target: Wall Street. Several major Wall Street firms faced the attacks, which use Voice over Internet Protocol (VoIP) calls. The problem is that the technique, which became possible some 20 years ago, is pretty much immune to any cybersecurity measures the affected funds are able to implement. In fact, the basic idea behind the exploit goes back some 50 years to when early hackers used "phone phreaking" to coax key info from unsuspecting targets.RELATED: This throwback app is competing with Big Tech — using a business model out of the 1980s Zak Bennett/Bloomberg/Getty Images Among the attacked firms was Citadel, the financial services company that manages over $70 billion in assets. While Citadel has not publicly offered any inside information on what happened, another firm that was attacked, Point72 Asset Management, offered some bread crumbs by saying no customer information was stolen, per Reuters.Two Sigma, the private hedge fund responsible for $75 billion in assets, provided the most detail when it said it caught the attempt before any information was compromised."Our security team responded quickly to an attempted vishing campaign targeting Two Sigma and other investment managers, and we have no indication of any impact to our data or our systems," a spokesperson said, according to Briefs Finance.Scattered Spider has been linked to Russian-speaking hackers called AlphV/BlackCat, using VoIP calls to trick IT workers into bypassing multifactor authentication.Employees can relatively easily be tricked into granting access or providing login information to major institutions and chains.The phone-call tactic is still widely used due to its effectiveness. RELATED: Is this the number-crunchers' come-to-Jesus moment? Emile Wamsteker/Bloomberg/Getty Images The FBI has warned about these scams since 2007, warning citizens to answer "vishing" attempts at accessing their personal information "with a healthy dose of skepticism."Businesses are warning of "social engineering" as a practice of manipulation that can affect gatekeepers of sensitive information.Cloudflare has categorized these phone-call breach attempts along the same lines as a fake delivery truck driver or a cyber attack. In most cases, these attacks aim to get the victim to divulge either login credentials or sensitive financial information.Like Blaze News? Bypass the censors, sign up for our newsletters, and get stories like this direct to your inbox. Sign up here!
The hacking group Scattered Spider, suspected in a major 2023 Las Vegas casino attack, is now implicated in targeting Wall Street firms using ‘vishing,’ a voice-based social engineering technique. This method exploits human trust to bypass security, reminiscent of 50-year-old ‘phone phreaking’ tactics and becoming increasingly difficult to defend against. While some firms like Two Sigma thwarted the attempts, others like MGM casinos experienced significant disruptions, highlighting the persistent vulnerability of even advanced systems to these older exploit methods.
- Scattered Spider, a hacking group, is suspected of using ‘vishing’ (voice phishing) to attack major Wall Street firms.
- This technique involves tricking IT staff via phone calls to bypass security measures like multi-factor authentication.
- The method is an evolution of ‘phone phreaking,’ a tactic used by hackers dating back 50 years.
- The FBI has warned about ‘vishing’ scams since 2007.
- In 2023, Scattered Spider allegedly used a similar method to attack MGM casinos, causing widespread network disruptions.
- Firms like Citadel, Point72 Asset Management, and Two Sigma were among those targeted on Wall Street.
- While Two Sigma reported catching the attempt before data compromise, other firms’ experiences remain less clear.
- The effectiveness of vishing lies in its ability to manipulate individuals into divulging credentials or sensitive information.
Write a comment