Overview

• The FBI and cybersecurity firms have confirmed that the Scattered Spider collective targeted the aviation sector in coordinated late-June attacks.
• WestJet reported an ongoing breach since June 13 and Hawaiian Airlines disclosed an IT systems compromise this month with no impact on flight safety.
• Scattered Spider operatives use social engineering to impersonate employees at help desks and bypass multi-factor authentication via unauthorized device additions.
• Mandiant and Palo Alto Networks recommend airlines strengthen help desk identity verification, secure self-service password resets, and reinforce authentication processes.
• The group’s shift to airlines follows recent retail and insurance intrusions, underscoring the challenges of defending critical infrastructure from agile social engineering threats.