On the evening of 10 September 2023, MGM Resorts International suffered a cyberattack that shut down casino operations across Las Vegas and multiple US states. Slot machines went dark. Hotel check-in systems failed. Rewards accounts became inaccessible. The disruption lasted for days and cost the company an estimated $100 million.
The compromise began with a single phone call to MGM’s IT help desk.
The caller claimed to be an MGM employee who had lost access to their account. They had the target’s name, title, basic work history, all gathered from LinkedIn in a matter of minutes. A help desk agent, following standard account recovery procedures, reset the account and provided temporary credentials.
Those credentials, in the hands of Scattered Spider, were enough.
Who Scattered Spider Is
Scattered Spider, also tracked as UNC3944, Starfraud, and Muddled Libra, is unusual among the threat actors covered in this publication. Its members are believed to be predominantly young, English-speaking Westerners: primarily American and British nationals, some reportedly still in their teens or early twenties at the time of the most significant attacks. And its primary weapon is not a CVE. It’s a phone call.
The group operates from a loosely affiliated online community sometimes called “The Com,” a network with shared skills, overlapping operations, and a criminal marketplace culture that emerged from gaming and SIM-swapping circles. Operational security is inconsistent: several members have been arrested, including a 17-year-old in the UK and multiple individuals in the US, but the techniques they developed are documented well enough that analysts can track their fingerprints across incidents.
What makes them genuinely dangerous is not technical sophistication. It’s the recognition that human beings are reliably the weakest link in any access control architecture, and that most organisations have invested almost nothing in hardening that layer.
The Playbook: People Before Packets
Every Scattered Spider operation starts the same way. Reconnaissance. Not vulnerability scanning, but research.
Building the target profile. Before any technical action, the group maps the organisation: IT and security staff by name, their likely access levels, the systems they manage, authentication procedures they’re expected to follow. LinkedIn is the primary source. Company websites, online directories, and social media fill in the gaps. The goal is a profile convincing enough to impersonate the target on a phone call.
Vishing. Help desk calls are the primary vector. Callers impersonate employees, contractors, vendors, whoever makes the pretext most plausible. They use real names, real scenarios, sometimes voice-spoofed caller IDs showing internal numbers. Help desk agents in large organisations take hundreds of calls a day. They are trained to resolve problems. Treating every caller as a potential attacker is not in their job description, and Scattered Spider understands that.
MFA fatigue. Once credentials are obtained, modern multi-factor authentication is an obstacle, unless you make it intolerable. Repeated push notification floods sent to a target’s phone until they approve one by accident or just to make it stop. Authentication app vendors have added number matching and contextual prompts to blunt this, but the technique remains viable against organisations that haven’t deployed those controls.
SIM swapping. For targets with SMS-based 2FA, the solution is simpler: convince a mobile carrier to transfer the victim’s number to an attacker-controlled SIM. Scattered Spider members have demonstrated sophisticated SIM-swapping capability, sometimes through corrupt carrier employees, sometimes by social-engineering carrier help desks directly. If your high-privilege accounts use SMS as a second factor, that’s not a second factor.
Vendor impersonation. Once inside, the group has impersonated IT security vendors (Okta, CrowdStrike) in follow-on communications with IT staff to escalate access or install remote access tools under the guise of incident response. This works because it exploits exactly the kind of trust that enables legitimate security operations.
MGM and Caesars: The Same Month, Two Different Decisions
The September 2023 attacks on MGM and Caesars Entertainment were not coincidental. They were part of the same operational tempo, and they produced a case study in the available responses.
Caesars was reportedly hit in August 2023, before the MGM attack became public. Caesars paid approximately $15 million (half the $30 million initially demanded) to prevent publication of stolen data. The company disclosed the incident in a regulatory filing in September, timed to coincide with the public attention on MGM. Most people didn’t notice.
MGM chose not to pay. The consequences were visible: ten days of operational disruption, systems rebuilt from scratch, public disclosures that generated regulatory scrutiny and legal exposure. The $100 million cost estimate includes lost revenue, recovery costs, and ongoing remediation. ALPHV/BlackCat affiliates collaborated on the MGM attack, providing the ransomware deployment capability that complemented Scattered Spider’s social engineering access.
The comparison isn’t a clean lesson. Paying ransoms funds further operations and doesn’t guarantee data won’t surface. Not paying means absorbing the operational impact and hoping data exposure doesn’t compound it. Both paths impose serious cost. The only good outcome is preventing the attack entirely, and that’s a separate conversation.
Why Technical Defences Don’t Solve This
The architecture of technical security is built on a specific assumption: attackers are exploiting technical vulnerabilities. Patch the vulnerability, harden the configuration, deploy the detection tool: reduce the attack surface.
Social engineering attacks exploit human vulnerabilities. The help desk agent who reset the MGM employee’s account wasn’t making a mistake by the standards of their training. They were following their job. The failure was systemic, not individual: a system that permitted a single phone call to grant access to a high-privilege account without identity verification that went beyond things anyone with LinkedIn access could know.
That’s a genuinely hard defensive problem, and most organisations haven’t seriously attempted to solve it.
Scale and friction. Large organisations receive hundreds of legitimate help desk requests daily. Treating every call as a potential attack creates friction that imposes real operational costs. Getting the balance right is hard and there’s no formula that works across organisations.
The knowledge-based verification failure. When a caller has your employee’s real name, title, manager’s name, employee ID, and home city (all public information), what verification procedure distinguishes them from the real employee? Knowledge-based verification has been defeated. Hardware-based identity verification is the answer for sensitive account recovery, and most organisations haven’t deployed it.
The insider threat dimension. In documented Scattered Spider cases, the group has recruited or bribed mobile carrier employees to execute SIM swaps. Technical controls cannot fully address that.
What Actual Defences Look Like
Eliminate knowledge-based account recovery for privileged accounts. Any process that allows a caller to reset credentials or MFA by answering security questions needs to be replaced with hardware token verification or manager-approval workflows. Help desks should be architecturally incapable of resetting high-privilege accounts; that function should belong to identity management systems with proper approval chains.
Deploy phishing-resistant MFA. FIDO2 hardware keys and passkeys are not vulnerable to MFA fatigue attacks or SIM swapping. For IT admins, finance personnel, and senior executives (anyone with access that would be valuable to an attacker), SMS-based 2FA is not meaningful protection against a group with SIM-swapping capability.
Audit your organisation’s OSINT footprint. The information available from public sources about your internal structure, staff roles, and technology environment is an attacker research asset. Overly detailed LinkedIn profiles for IT and security personnel are reconnaissance material. That doesn’t mean removing everyone from LinkedIn; it means being deliberate about what gets published.
Run social engineering simulations. Most penetration tests focus on technical controls. Red team exercises that include vishing, pretexting, and help desk impersonation give a realistic picture of human control effectiveness. Most organisations find significant gaps. That’s the point.
Treat help desk as a security control, not a cost centre. Help desk staff need specific social engineering resistance training built from documented attack scenarios, with clear escalation paths for suspicious calls. Not a one-hour annual module, but regular reinforcement with updated scenarios, because the group adapts.
Scattered Spider isn’t going anywhere. The techniques work, the group is adaptive, and the criminal ecosystem supporting it regenerates even as arrests are made. The organisations that don’t become victims are the ones that have taken their identity and help desk controls as seriously as their network perimeter. Most haven’t got there yet.