Overview

• The FBI warned that Scattered Spider has broadened its campaign to target the airline ecosystem, including third-party IT providers and contractors.
• Breaches at WestJet on June 13 and Hawaiian Airlines on June 23 have been linked to the group’s schemes to add unauthorized multi-factor authentication devices and gain persistent network access.
• Operatives exploit advanced social engineering by impersonating employees or contractors to persuade help desk staff to reset credentials and enroll rogue authentication devices.
• Despite the 2024 arrests of key members such as alleged leader Tyler Buchanan, the decentralized, teen-dominated collective continues evolving its tactics with AI-generated phishing to infiltrate sectors from insurance to aviation.
• The FBI is collaborating with cybersecurity partners including Mandiant and Unit 42 to share intelligence, issue alerts, and implement stricter verification measures across the aviation supply chain.