It is being reported by Google that the Scattered Spider group have been aggressively targeting virtualized environments by attacking VMware ESXi hypervisors at U.S. companies in the retail, airline, transportation, and insurance sectors.
The group’s core tactics have remained consistent and do not rely on software exploits. Instead, they use a proven playbook centered on phone calls to an IT help desk. The actors are aggressive, creative, and particularly skilled at using social engineering to bypass even mature security programs. Their attacks are not opportunistic but are precise, campaign-driven operations aimed at an organization’s most critical systems and data.
Their strategy is rooted in a “living-off-the-land” (LoTL) approach. After using social engineering to compromise one or more user accounts, they manipulate trusted administrative systems and use their control of Active Directory as a launchpad to pivot to the VMware vSphere environment, thus providing an avenue to exfiltrate data and deploy ransomware directly from the hypervisor. This method is highly effective as it generates few traditional indicators of compromise (IoCs) and bypasses security tools like endpoint detection and response (EDR), which often have limited or no visibility into the ESXi hypervisor and vCenter Server Appliance (VCSA).
Ensar Seker, CISO at SOCRadar had this comment:
“Scattered Spider’s targeting of VMware ESXi environments marks a concerning escalation in their tactics, especially given the central role ESXi hypervisors play in enterprise infrastructure. What makes this campaign particularly dangerous is not zero-day exploits or novel malware, but the sheer precision of their social engineering. These attackers are bypassing layered defenses by manipulating human trust, impersonating IT staff, abusing MFA processes, and gaining privileged access without firing a single exploit.”
“This highlights a serious blind spot: even organizations with strong patching, segmentation, and endpoint defenses are vulnerable if their identity verification and access workflows can be tricked. The fact that attackers are going straight for hypervisors, the backbone of many corporate data centers, shows they understand where the crown jewels live. Once they get access to ESXi, they can rapidly encrypt or exfiltrate data across many virtual machines, amplifying impact.”
“For defenders, this underscores the urgency of hardening identity and access management. That means enforcing phishing-resistant MFA, separating duties in high-privilege environments, locking down direct access to management interfaces like ESXi, and monitoring for behavioral anomalies across IAM platforms. Security training alone won’t cut it, social engineering resilience must be engineered into systems and processes. We’re not just defending code anymore; we’re defending trust.”
James McQuiggan, Security Awareness Advocate at KnowBe4:
“Scattered Spider is proving that breaches don’t always start with technical exploits. They start with a phone call. As they continue to use social engineering to impersonate employees, trick help desks, and gain access to user accounts, they are leveraging the human trust and lack of awareness of users who fall victim to this attack style to gain access and launch their ransomware attacks.”
“What makes this approach so effective is how well it blends human deception with infrastructure-level exploitation. To defend against this, organizations need to treat social engineering as seriously as they treat compliance, patching and securing their VPNs. Help desks should verify identities using more than just names or IDs, and multifactor authentication should be phishing-resistant.”
“Security awareness training must go beyond generic advice and include realistic scenarios that reflect the current tactics employed by attackers, such as impersonating internal staff or creating a sense of urgency to bypass standard procedures. Building resilience means securing both layers, an organization’s systems and their users.”
I have to admit that this is a pretty crafty attack by Scattered Spider. It shows that you have to be on guard for multiple attack vectors to avoid getting pwned.
How a simple service desk attack cost Clorox $400 million
Posted in Commentary with tags Hacked on July 28, 2025 by itnerdLast week, cleaning products giant Clorox took the unusual step of suing its IT services partner Cognizant for gross negligence.
Clorox are alleging that the August 2023 ransomware attack they suffered came about thanks to an incredibly simple piece of human error. According to the complaint, hackers tied to the “Scattered Spider” group simply phoned Cognizant’s service desk and requested a password reset – and were given one. You can see my coverage on this here.
Today, Specops Software published an analysis on how a simple service desk attack cost Clorox $400 million. Which is up from the $49 million that I first reported.
This analysis not only goes into how exactly the service desk social engineering played out, but also how the ransomware was deployed, and what organizations can do to protect their service desks.
The full details can be found here: https://specopssoft.com/blog/clorox-password-social-engineering/
Leave a comment »