Scattered Spider Is Now Targeting Aviation

Scattered Spider (UNC3944) has expanded beyond retail and insurance into active campaigns against the airline sector, exploiting large help desks and outsourced IT functions through social engineering. This report covers:

  • Victim patterns and targeted sectors
  • Full MITRE ATT&CK mapping, from initial access through impact
  • Indicators of compromise: C2 domains, file hashes, and IP addresses
  • Prioritised mitigation steps across identity, endpoints, applications, network, and monitoring
  • Smarttech247 SOC countermeasures already deployed against this actor

How Smarttech247 Responded

Smarttech247's SOC deployed custom detection rules mapped to Scattered Spider's specific TTPs, blocked known IOCs across security tooling, and ran retrospective threat hunting against historical logs to check for prior compromise.

  • Custom detection rules targeting Scattered Spider TTPs
  • IOC blocking across relevant security tools
  • Retrospective threat hunting using known indicators
Get Your Guide