[high] MGM Resorts and Caesars hit by Scattered Spider

Thu, 05 Oct 2023 00:00:00 GMT

Scattered Spider, an ALPHV/BlackCat affiliate, used social engineering to breach two Las Vegas casino giants. Caesars lost its loyalty program database and reportedly paid about $15M. MGM shut down systems for days and estimated a $100M hit, with pre-March-2019 customer data stolen.

Status: closed · Patch: no-fix-needed

Latest updates:

2023-10-05: MGM 8-K: about $100M impact on Adjusted Property EBITDAR, data of customers from before March 2019 stolen (source)
2023-09-14: Caesars 8-K filing; reports say it paid about half of a $30M demand (source)
2023-09-12: MGM statement on the cybersecurity issue (source)

[high] Retool breach: SMS phishing, deepfaked voice call and synced MFA codes

Wed, 13 Sep 2023 00:00:00 GMT

An attacker phished a Retool employee by SMS, then called them with a deepfaked voice to get an MFA code. Because Google Authenticator synced codes to the employee's Google account, the attacker got their MFA codes too, and took over 27 cloud customer accounts, all in crypto.

Status: closed · Patch: no-fix-needed

Latest updates:

2023-09-13: Retool publishes its write-up (source)
2023-08-27: SMS phishing and voice call lead to compromise of a Retool employee account and 27 cloud customers (source)

pwn.watch: Social Engineering incident updates

[high] MGM Resorts and Caesars hit by Scattered Spider

[high] Retool breach: SMS phishing, deepfaked voice call and synced MFA codes