ALERT: FBI Warns Scattered Spider Is Now Targeting Airlines with Social Engineering Attacks

What happened, why it matters, why now:
The FBI has issued a rare airline-sector alert after observing the cybercriminal group Scattered Spider pivoting to target airlines and aviation vendors through sophisticated social engineering techniques and MFA bypass.

With disruptions already reported at Hawaiian Airlines and WestJet, this expansion signals growing threats to critical infrastructure immediately elevating urgency across the airline ecosystem, according to FBI.
Why now? Because attackers are weaponizing trust with help desk personnel to bypass traditional security controls just as air travel rebounds globally.

Scattered Spider’s New Aviation Focus

Timeline & Incident Overview

• June 2025: The FBI notices Scattered Spider targeting airline systems via deceptive social-engineering attacks—impersonating employees or contractors to exploit help desks and install unauthorized MFA devices.
• Also in June: Hawaiian Airlines discloses a cybersecurity incident affecting internal IT systems, likely linked to the group.
• June 12, 2025: Canada’s second-largest airline, WestJet, confined access to internal services—later attributed by BleepingComputer to Scattered Spider via MFA bypass and password resets.
• June 27, 2025: Mandiant’s Charles Carmakal and Palo Alto Unit 42’s Sam Rubin publicly confirm Scattered Spider’s activity in aviation.

FBI & Cybersecurity Firms Sound the Alarm

• The FBI urges kinetic cooperation: “actively working with aviation and industry partners… share intelligence… prevent further compromise” .
• Mandiant advises strengthening help desk identity verification prior to adding new phone numbers or MFA devices.

Technical Breakdown

Social Engineering & MFA Bypass TTPs

Scattered Spider’s attack sequence (aligned with FBI/CISA CSA):

1. Impersonation of IT/help desk personnel via calls or SMS phishing (T1566, T1598).
2. MFA fatigue or unauthorized MFA device registration to bypass 2FA protections (T1621, T1556.006).
3. Self-service password resets via help desk manipulation (T1606.002, T1078.002).
4. Use of legitimate remote tools (AnyDesk, Ngrok, Fleetdeck, etc.) for lateral movement (T1219, T1211).
5. Data theft, extortion, ransomware using stolen access via double-extortion schemes.

MEA & Global Implications

Middle East & Africa

• Airlines and vendors based in Dubai, Doha, Lagos, Nairobi, and Johannesburg could be targeted, especially those using outsourced IT helpdesk support.
• Regional regulators (e.g., UAE NESA, SAFACOM, Kenya DP‑Act) may consider issuing targeted advisories.
• Insurance-linked aviation services across MEA remain at elevated risk due to shared vendor infrastructures.

Global Comparison

• Scattered Spider previously disrupted MGM, Caesars, MailChimp, Twilio, and UK retailers.
• Now shifting focus to critical infrastructure, this escalates the threat landscape from commercial to national-level security.

Expert Commentary

“Organizations should be on high alert for sophisticated and targeted social engineering attacks and suspicious MFA reset requests,” warned Sam Rubin, SVP at Palo Alto Unit 42 (bleepingcomputer.com).

“These actors rely on social engineering… impersonating employees or contractors to deceive IT help desks… frequently bypassing multi‑factor authentication,” according to the FBI (thehackernews.com).

Technical Summary: MITRE TTPs Box

Initial Access:
  • T1566 – Phishing/Social Engineering
  • T1598 – Phishing via Service Desk
Execution:
  • T1556.006 – MFA Enrollment
Persistence:
  • T1606 – Account Manipulation
Privilege Escalation:
  • T1078.002 – Hijacking Service Accounts
Lateral Movement:
  • T1219 – Remote Remote Access Tools (AnyDesk, Ngrok)
Impact:
  • T1486 – Ransomware / Data Encryption
  • T1490 – Data Destruction

Actionable Takeaways

1. Harden help desk workflows – Require secondary verification before phone/MFA changes.
2. Enforce phishing-resistant MFA – Use FIDO2, hardware tokens.
3. Monitor MFA logs – Alert on unexplained device enrollments.
4. Restrict self-service password resets – Use strict identity proofing.
5. Lock down remote-access tools – Whitelist only approved software.
6. Segment networks – Isolate help desks from critical systems.
7. Employee training – Raise awareness of social-engineering methods.
8. Deploy identity‑centric monitoring – Log admin-level identity events in SIEM.

Conclusion

The FBI’s alert on Scattered Spider targeting the airline sector underscores the shift from opportunistic financial crimes to critical infrastructure threats. With airlines in MEA and beyond now on the radar, CISOs and SOC teams must tighten identity workflows and enhance help‑desk security. Staying ahead means less focus on endpoint tools and more on human‑centric defenses—because attackers already are.

Sources

• Axios: Aviation, Transportation Sector Cyberattacks (27 June 2025)
• Reuters: Tech Firms Warn Scattered Spider Hacks in Aviation (27 June 2025)
• The Hacker News: “FBI Warns of Scattered Spider” (28 June 2025)
• BleepingComputer: “Scattered Spider hackers shift focus…” (27 June 2025)
• CISA/FBI CSA (November 2023 summary)
• Halcyon: Scattered Spider tactics analysis (20 June 2025)

For ongoing cybersecurity news, alerts, and best practices, follow CyberCory.