In September 2023, MGM Resorts International had its systems knocked offline for ten days. Slot machines stopped working. Hotel check-in went down. Digital key cards failed. The estimated financial damage was over $100 million. The tool the attackers used to start the whole thing was a phone.

The group responsible goes by the name Scattered Spider. The FBI and CISA issued a joint advisory about them in November 2023, and what the advisory describes should unsettle every organisation that runs an IT help desk.

Who Scattered Spider Actually Is

Scattered Spider is an English-speaking group, largely made up of young people, some reportedly still in their teens at the time of the MGM attack. They are not traditional hackers in the technical sense. They are exceptionally skilled social engineers who have studied how IT support teams operate and built a playbook around the one thing technical controls cannot easily stop: a convincing phone call.

The FBI advisory confirmed the group targets large organisations in hospitality, gaming, telecommunications, technology and financial services. They use a rotating set of aliases and have been tracked under names including UNC3944 and Octo Tempest by threat intelligence firms.

The Five Steps of a Typical Attack

As documented in the FBI/CISA joint advisory and subsequent reporting by Wired and KrebsOnSecurity, the attack chain follows a consistent pattern:

• Find a real employee using LinkedIn, company directories or social media
• Call the IT help desk posing as that employee, claiming to be locked out
• Request a password reset and either a new MFA device registration or a phone number change
• Use the new access to move through cloud platforms such as Okta, Microsoft Azure and Slack
• Deploy ransomware, exfiltrate data or both, depending on the objective

Caesars Entertainment paid a $15 million ransom after a similar attack. MGM refused to pay and absorbed the operational disruption instead. In both cases the initial access required no malware, no exploit and no technical sophistication.

Why Your Current Controls Do Not Stop This

MFA is one of the most recommended security controls in the industry. Scattered Spider treats it as a starting point. The FBI advisory documents their use of MFA fatigue attacks, where the attacker pushes repeated authentication requests until an exhausted employee approves one to make it stop. They also conduct SIM swapping, calling mobile carriers to have the target’s phone number transferred to an attacker-controlled SIM, which reroutes all SMS codes. Both techniques defeat the MFA controls that most organisations have implemented.

The deeper problem is that help desk staff are trained to help people. An employee who sounds stressed, knows the right internal terminology and references a real meeting they are about to miss is convincing. Creating a culture where help desk staff can verify identity under pressure, without feeling rude or unhelpful, is harder than deploying a technical control.

What Actually Works

The FBI advisory recommends several specific controls:

• Require callback verification to a number on record, not a number the caller provides
• Implement identity verification that does not rely solely on knowledge of internal information
• Log and review all help desk password reset requests
• Restrict MFA device registration to verified processes with manager approval
• Use phishing-resistant MFA such as FIDO2 keys for all administrative accounts
• Train help desk staff specifically on social engineering scenarios with regular simulated calls