Agencies recommend action to defend against cybercrime group

The FBI and Cybersecurity and Infrastructure Security Agency Nov. 16 recommended health care and other critical infrastructure take steps to protect their networks from the Scattered Spider group, which uses social engineering techniques and legitimate remote access tools to compromise victim networks, extort ransom and steal data. 
 
“Scattered Spider’s sophisticated technical cyberattacks begin with sophisticated psychological attacks,” said John Riggi, AHA’s national advisor for cybersecurity and risk. “Scattered Spider employs social engineering techniques to deceive end users into providing their credentials, authentication codes or downloading ‘help desk’ tools on their computers that allow the adversary to gain and maintain persistent access to computer networks. Staff should be advised of help desk verification protocols and that help desk personnel should not be asking staff to divulge their credentials or multi-factor authentication codes. Conversely, the help desk should enhance its verification protocols and challenge questions to ensure they do not improperly reset staff credentials and to help staff distinguish valid help desk interaction from social engineering attempts.”
 
For more information on this or other cyber and risk issues, contact Riggi at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.