Scattered Spider, BlackCat Reemerge After Takedown

New groups show striking similarities in tools and tactics.

Two cybercriminal groups appear to have reemerged after a brief hiatus.

Scattered Spider and BlackCat (aka ALPHV) had seemingly vanished after a series of high-profile arrests and website seizures last year.

However, security firm ReliaQuest attributed a recent digital break-in at a manufacturing firm to Scattered Spider.

"In October 2024, ReliaQuest responded to an intrusion affecting a manufacturing sector customer. We identified Scattered Spider to be behind the incident," the company said.

The attack involved a social engineering scheme targeting the victim's help desk.

"The attacker gained initial access to two employee accounts by carrying out social engineering attacks on the organization's help desk twice. Within six hours, the attacker began encrypting the organization's systems.

"To maintain persistence, Scattered Spider leveraged the organization's ESXi environment to create a virtual machine. This concealed their attack until the environment was encrypted and backups were sabotaged.”

Scattered Spider has successfully breached numerous high-profile organizations in the past by exploiting vulnerabilities in human behavior.

A notable shift in the group's tactics is their adoption of the RansomHub encryptor.

Previously affiliated with BlackCat/ALPHV, this change suggests a potential strategic realignment or an effort to diversify the group’s toolkit.

Cybersecurity experts warn that the resurgence of these groups poses a significant threat to organizations worldwide.

Scattered Spider gang is thought to be part of a larger cybercriminal community dubbed "The Com."

"This event demonstrates that despite arrests this year, members of The Com are still actively targeting organizations," Hayden Evans, cyber threat intelligence analyst at ReliaQuest, told The Register.

BlackCat Returns

The infamous ransomware group BlackCat/ALPHV also appears to have resurfaced after a brief period of dormancy, albeit under a new guise.

The FBI announced its successful disruption of the BlackCat ransomware operation in December last year. The operation, conducted in collaboration with international law enforcement agencies, dismantled the group’s ransomware infrastructure and provided a decryption tool to hundreds of victims.

BlackCat, a sophisticated ransomware-as-a-service (RaaS) group, had wreaked havoc on countless organisations worldwide. The gang's modus operandi involved infiltrating networks, encrypting sensitive data and demanding ransom payments. By exfiltrating data before encryption, BlackCat employed a double-extortion tactic, placing further pressure on victims to pay up.

The FBI's operation involved a technical intrusion into BlackCat's infrastructure, allowing agents to silently monitor the group's activities for months. The operation enabled the agency to collect critical intelligence, including decryption keys for a large number of victims.

By seizing control of the group's data leak site, the FBI effectively neutralized a key tool used to extort victims.

However, security researchers say the group has now re-emerged as Cicada3301, whose techniques and tactics bear striking similarities BlackCat's.

Since its discovery in June, Cicada3301 ransomware has targeted at least 39 victims.

Cicada's malware is written in Rust, similar to BlackCat, and shares multiple characteristics with other data-encrypting and data-wiping programs, as analyzed by Israeli endpoint security company Morphisec.

In recent findings, Group-IB threat hunters reported successfully infiltrating the Cicada3301 ransomware affiliate panel.

"These ransomware operators – whether it's Scattered Spider through RansomHub or this new Cicada ransomware group – are inherently opportunistic," said ReliaQuest’s Evans.

"A large majority of the time the tactics of these groups overlap. It's super important for defenders to identify these common TTPs and common tools of these groups and have detection, mitigations in place."

This article originally appeared on our sister site Computing.