Home
/
Resources

Scattered Spider Is Now Targeting Aviation

Peer Review

Gartner brand name text logo in white with registered trademark symbol.
5-star rating
4.8

Proven Trust

Dark blue circle with two overlapping checkmarks, one green and one light blue.
ISO 27001 text with a globe outline symbol on a black background.
2025 winner badge for Cyber Security Excellence Awards with gold and black design.

Scattered Spider (UNC3944) has expanded beyond retail and insurance into active campaigns against the airline sector, exploiting large help desks and outsourced IT functions through social engineering. This report covers:

  • Victim patterns and targeted sectors
  • Full MITRE ATT&CK mapping, from initial access through impact
  • Indicators of compromise: C2 domains, file hashes, and IP addresses
  • Prioritised mitigation steps across identity, endpoints, applications, network, and monitoring
  • Smarttech247 SOC countermeasures already deployed against this actor

How Smarttech247 Responded

Smarttech247's SOC deployed custom detection rules mapped to Scattered Spider's specific TTPs, blocked known IOCs across security tooling, and ran retrospective threat hunting against historical logs to check for prior compromise.

  • Custom detection rules targeting Scattered Spider TTPs
  • IOC blocking across relevant security tools
  • Retrospective threat hunting using known indicators
Get Your Guide

Who This Guide is For

CISO / Head of Security

Scattered Spider has moved beyond retail and insurance into aviation. This report gives you full MITRE ATT&CK mapping and the mitigations that follow.

IT Director / Head of IT

This actor exploits large help desks and outsourced IT through social engineering. This report shows exactly where that exposure sits.

SOC Manager / Security Operations Lead

IOCs, C2 domains, and file hashes are included directly, along with the countermeasures Smarttech247's SOC has already deployed.