Better Security, Together

Several US government agencies, including CISA, the FBI, the NSA, and the DoD Cyber Crime Center, have issued a fresh warning highlighting the elevated risk of Iranian state-backed cyber operations in light of recent geopolitical tensions. Officials warn that Iranian and pro-Iranian threat actors may retaliate for recent US military actions with disruptive attacks targeting critical infrastructure sectors, including energy, water, manufacturing, and healthcare. Of particular concern are unsophisticated but effective intrusions against internet-exposed industrial control systems (ICS) and operational technology (OT) using default credentials or weak configurations.

Organizations operating ICS/OT, especially those in sectors historically targeted by Iranian actors, are urged to review the new fact sheet, assess their exposure, and immediately implement hardening measures — such as eliminating default passwords and securing remote access — to reduce risk of exploitation. CISA emphasizes that while no coordinated campaign has yet been observed, the threat remains credible and proactive mitigation is strongly recommended.

Scattered Spider continues its high-impact campaign across industries, with new activity observed in the aviation sector following earlier waves of attacks on the retail and insurance verticals. Known for its aggressive and coordinated social engineering operations, the group maintains consistent TTPs—primarily leveraging phishing to impersonate IT support staff, gaining access to Microsoft Entra ID, SSO, and VDI environments. From there, they pivot into integrated SaaS platforms to facilitate lateral movement and exfiltrate data before deploying ransomware—typically on VMware ESXi systems. The group tends to concentrate on one sector at a time, often for a few weeks, and has shown no signs of slowing.

Recent incidents include a cyberattack on Qantas Airlines, confirmed on July 2, involving a third-party customer service platform that may have exposed data for up to 6 million customers. While attribution has not been formally announced, the TTPs align with known Scattered Spider activity—mirroring earlier intrusions at Hawaiian Airlines and WestJet. The FBI also issued a June 27 warning that the group is now targeting the airline ecosystem more broadly during peak season, including trusted vendors and contractors. In parallel, Scattered Spider has been observed using phishing frameworks like Evilginx and typosquatted domains impersonating IT service providers—enabling them to bypass MFA protections and harvest valid session tokens. These refinements enhance their ability to compromise cloud-first environments and escalate access rapidly