FBI Warns of Scattered Spider Hacking Group Targeting Airlines

The FBI is warning airlines and travelers that an international hacking group known as “Scattered Spider” has set their sights on the airline industry. Known for using sophisticated social engineering tactics, the cybercriminal gang will likely aim to exploit in-flight Wi-Fi and entertainment systems to steal passengers’ data.

Scattered Spider, also known as UNC3944, is believed to consist primarily of teens and young adults residing in the US and UK. Targets tend to fall in the casino & gambling, financial, and insurance industries — customer-facing businesses that regularly handle sensitive information.

The group gained notoriety for a number of high-profile hacking and extortion crimes, involving Caesars Entertainment, MGM Resorts International, Marks & Spencer, and more. Many other cybergangs are suspected of either cooperating with or emulating Scattered Spider due to the efficacy of their methods. They employ a variety of attack vectors, including SIM swap scams, MFA fatigue attacks, and phishing (via SMS or Telegram).

Believed to have been founded in 2022, the prolific group’s activities have been actively tracked by the CISA and the FBI since 2023.

According to the FBI, Scattered Spider uses “social engineering techniques” to “bypass multi-factor authentication (MFA), such as convincing help desk services to add unauthorized MFA devices to compromised accounts.” They also tend to target “large corporations and their third-party IT providers.”

Airliners generally rely on third-party providers for their onboard communications and infotainment systems, which is why the FBI warns that the entire “airline ecosystem” is at risk, including “trusted vendors and contractors.”

The FBI has not disclosed exactly how the group is “expanding its targeting to include the airline sector,” or whether attacks have already taken place.

If Scattered Spider were to gain entry into sensitive systems, it could spell disaster for airline companies and customers alike. For example, an Air Europe breach in 2023 led the full exposure of some of its customers’ credit card details. It could also lead to major disruptions to international travel, such as when a faulty Crowdstrike update ground nearly the entire airline industry to a halt.