Scattered Spider Strikes Again: The Group Behind the MGM Attack Launches a New Campaign Targeting the Financial Sector

Recommendations for Enhancing Cybersecurity Against Scattered Spider Threats

The FBI and CISA suggest the following mitigations to strengthen cybersecurity defenses and minimize the risk posed by Scattered Spider actors. These align with the Cross-Sector Cybersecurity Performance Goals (CPGs) from CISA and NIST.

Application Controls and Remote Access Management

1. Control Software Execution: Implement application controls to allowlist remote access programs and block unauthorized software. This prevents malware that might evade antivirus detection.

2. Audit Remote Access Tools: Regularly audit and review logs for remote access tools to detect unauthorized use.

3. Use Security Software: Deploy security software to detect remote access tools loaded in memory. Ensure remote access solutions are used only through approved VPNs or VDIs.

4. Network Controls: Block remote access software ports at the network perimeter and follow the Guide to Securing Remote Access Software.

Multifactor Authentication (MFA) and Remote Desktop Protocol (RDP)

1. Implement Robust MFA: Use FIDO/WebAuthn or PKI-based MFA to protect against phishing, push bombing, and SIM swapping.

2. Limit RDP Usage: Minimize RDP use and follow best practices:

• Audit for RDP use.

• Close unused RDP ports.

• Enforce account lockouts after several failed attempts.

• Apply MFA.

• Log RDP attempts.

Recovery and Backup Strategies

1. Develop a Recovery Plan: Keep multiple copies of critical data in separate, secure locations.

2. Maintain Offline Backups: Regularly update offline backups to mitigate business disruptions.

Password Management and Network Security

1. Adhere to NIST Password Standards: Use strong, unique passwords, and consider password managers. Avoid password reuse and frequent changes.

2. Account Security:

• Implement lockouts after multiple failed login attempts.

• Disable password hints.

• Require administrator credentials for software installation.

Additional Security Measures

1. Phishing-Resistant MFA: Implement MFA for all critical services.

2. Timely Patching: Keep systems and software updated, prioritizing known vulnerabilities.

3. Network Segmentation: Segment networks to control and limit the spread of ransomware.

4. Network Monitoring: Use monitoring tools to detect and log network traffic and lateral movements. EDR tools are particularly effective.

5. Antivirus Software: Regularly update and enable real-time detection.

6. Disable Unused Ports: Close unused ports and protocols to reduce attack surfaces.

7. Email Security: Add banners to external emails and disable hyperlinks.

8. Secure Backup Data: Ensure backups are encrypted and immutable to protect against data tampering.

Implementing these measures will significantly enhance cybersecurity defenses and mitigate risks from Scattered Spider and similar threats.