Scattered Spider
What it means
CISA Cybersecurity Advisories ha pubblicato un advisory sul ransomware Scattered Spider. La fonte descrive vulnerabilita o tecniche gia osservate in attacchi e richiede una verifica prioritaria.
Why it matters
L'advisory descrive attivita ransomware osservate e misure difensive pubblicate da un'autorita. Non prova che il proprio perimetro sia compromesso, ma richiede una verifica prioritaria di esposizione e controlli.
Recommended actions
- Verificare e correggere con priorita i sistemi Internet-facing indicati dalla fonte; applicare MFA resistente al phishing, segmentazione e backup offline immutabili con prove di ripristino.
- Verificare sistemi esposti, accessi remoti e versioni rispetto all'advisory ufficiale.
- Confermare che backup offline e immutabili siano separati e ripristinabili.
- Correlare TTP e IOC pubblicati con la telemetria autorizzata del proprio perimetro.
Potential operational benefits
- Prioritizzazione delle esposizioni Internet e delle vulnerabilita sfruttate
- Verifica dei controlli su accessi remoti, movimento laterale ed esfiltrazione
- Validazione documentata della capacita di ripristino
Translation in progress
The official content is available in the original language. The Italian version will be published once automated checks are complete.
Text acquired from the source
Cybersecurity Advisory Scattered Spider Last Revised July 29, 2025 Alert Code AA23-320A CISA Product Feedback Survey Related topics: Cyber Threats and Response , Malware, Phishing, and Ransomware , Cybersecurity Best Practices Actions for Organizations to Take Today to Mitigate Malicious Cyber Activity Maintain offline backups of data that are stored separately from the source systems and tested regularly . Enable and enforce phishing-resistant multifactor authentication (MFA) . Implementing application controls to manage and control software execution. Summary The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Royal Canadian Mounted Police (RCMP), Australian Signals Directorate’s (ASD’s) Australian Cyber Security Centre (ACSC), Australian Federal Police (AFP), Canadian Centre for Cyber Security (CCCS), and United Kingdom’s National Cyber Security Centre (NCSC-UK)—hereafter referred to as the authoring organizations—are releasing this joint Cybersecurity Advisory in response to recent activity by Scattered Spider threat actors against the commercial facilities sectors, subsectors, and other sectors. This advisory provides tactics, techniques, and procedures (TTPs) obtained through FBI investigations as recently as June 2025. Note: Originally published Nov. 16, 2023, this advisory has been updated through several iterations: Nov. 16, 2023: Initial version. Nov. 21, 2023: Updated password recommendation language on page 12. July 29, 2025: U.S. and international federal organizations identified new TTPs associated with the Scattered Spider cybercriminal group. In addition to new TTPs that include more sophisticated social engineering techniques, the advisory describes additional malware and ransomware variants used to exfilt
- Source
- CISA Cybersecurity Advisories
- Publishing entity
- CISA
- Entity type
- National authority
- Area
- North America · US
- Original language
- en · translation in preparation
- Publication
- 29/07/2025 14:00
- Sharing
- TLP:CLEAR
- MITRE ATT&CK
- T1018, T1021.007, T1074, T1078, T1078.002, T1083, T1090, T1114, T1136, T1199, T1204, T1213.002, T1213.003, T1217, T1219, T1451, T1484.002, T1486, T1530, T1538, T1539, T1552.001, T1552.004, T1556.006, T1566, T1566.004, T1567, T1567.002, T1578.002, T1583.001, T1585.001, T1589, T1593.001, T1594, T1597.002, T1598, T1598.004, T1606, T1621, T1648, T1656, T1657, T1660
- Classification
- Critical
- Stated country
- US
Action indicated by the source
Verificare e correggere con priorita i sistemi Internet-facing indicati dalla fonte; applicare MFA resistente al phishing, segmentazione e backup offline immutabili con prove di ripristino.