Tech firms warn 'Scattered Spider' hacks are targeting aviation sector

Tech companies Google and Palo Alto Networks are sounding the alarm over the "Scattered Spider" hacking group's interest in the aviation sector.

In a statement posted on LinkedIn on Friday, Sam Rubin, an executive at Palo Alto's cybersecurity-focused Unit 42, said his company had "observed Muddled Libra (also known as Scattered Spider) targeting the aviation industry."

In a similar statement, Charles Carmakal, an executive with Alphabet-owned Google's cybersecurity-focused Mandiant unit, said his company was "aware of multiple incidents in the airline and transportation sector which resemble the operations of UNC3944 or Scattered Spider."


Neither executive identified which specific companies had been targeted, but Alaska Air Group-owned Hawaiian Airlines and Canada's WestJet have both recently reported being struck by unspecified cyber incidents.

Neither company has gone into detail about the intrusions or commented on any potential links between the incidents and Scattered Spider.

The loose-knit but aggressive hacking group, alleged to at least in part comprise youngsters operating in Western countries, has been blamed for some of the most disruptive hacks to hit the United States and Europe in recent memory.

In 2023, hackers tied to the group broke into gaming companies MGM Resorts and Caesars Entertainment, partially paralyzing casinos and knocking slot machines out of commission.

Earlier this year, the group wreaked havoc at British retailers. More recent targets include the U.S. insurance industry.