The aviation industry has seemingly become the latest target of Scattered Spider, a sophisticated cybercriminal group that has shifted its focus from retail and insurance companies to airlines in what cybersecurity experts describe as a coordinated campaign against the sector.

Hawaiian Airlines disclosed a cybersecurity incident Friday affecting some of its IT systems while maintaining that flights continued operating safely and on schedule. The attack, first detected June 23, according to SEC filings, prompted the airline to engage federal authorities and cybersecurity experts for investigation and remediation efforts.

Multiple incident responders have attributed the Hawaiian Airlines attack to Scattered Spider, also known as Muddled Libra or UNC3944. The assessment comes as cybersecurity firms Unit 42 and Mandiant issued warnings about the group’s apparent pivot to targeting aviation companies.

Charles Carmakal, chief technology officer at Mandiant Consulting – Google Cloud, confirmed his company is “aware of multiple incidents in the airline and transportation sector which resemble the operations of UNC3944 or Scattered Spider.” The group has demonstrated a pattern of focusing intensively on single industries before moving to new sectors.

“Given the habit of this actor to focus on a single sector we suggest that the industry take steps immediately to harden systems,” Carmakal stated.

The Hawaiian Airlines incident follows a similar attack earlier this month on WestJet, Canada’s second-largest airline. The Calgary-based carrier experienced intermittent disruptions to its website and mobile application, with systems largely restored after five days.

Cybersecurity experts note that Scattered Spider has maintained consistent tactics across different industry targets. The group typically employs sophisticated social engineering attacks and targets multi-factor authentication systems through fraudulent reset requests.

Sam Rubin, senior vice president of consulting and threat intelligence at Palo Alto Networks’ Unit 42, emphasized that organizations should maintain “high alert for sophisticated and targeted social engineering attacks and suspicious MFA reset requests.”

The group’s methodical approach to targeting specific industries has previously included campaigns against major retail chains and insurance companies, including attacks on Aflac and other prominent insurers.

The coordinated nature of these attacks across multiple airlines suggests a strategic shift by Scattered Spider toward critical infrastructure sectors. The Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency have yet to comment on the incidents.

The post Scattered Spider strikes again? Aviation industry appears to be next target for criminal group appeared first on CyberScoop.

from CyberScoop https://ift.tt/sSNhrv9
via IFTTT

Data management company Rubrik announced plans Wednesday to acquire artificial intelligence startup Predibase, a move aimed at accelerating the adoption of agentic AI in enterprise settings and pushing efficient AI deployments from pilot programs into full production.

The terms of the deal were not made public, but sources familiar with the situation told CNBC the sale price may range from $100 million to $500 million. Predibase, which was founded in 2021 by former Google and Uber employees, has received over $28 million in funding.

Rubrik, which went public last year, is known for enterprise data protection and recovery services. The company has reported over $1 billion in annualized revenue and a significant increase in value since its initial public offering. Rubrik’s acquisition of Predibase represents its most substantial step yet toward integrating more advanced AI tools with its existing offerings.

Predibase’s platform allows organizations to fine-tune open-source AI models for specific business use cases, and to operate at production scale without massive infrastructure expenses. The company’s technology stack features a proprietary post-training customization toolkit and an open-source system known as LoRA eXchange for personalized model deployment.

For Rubrik, leveraging Predibase’s technology opens pathways to deliver “radical simplicity” in AI models and data management, according to company executives. The deal aims to address persistent industry bottlenecks such as high infrastructure costs, limited model accuracy, data governance hurdles, and slow transitions from pilot to production.

Rubrik’s acquisition aligns with broader efforts across the AI and cloud industry to streamline and secure the deployment of generative AI applications. The move complements its existing collaborations with Amazon Bedrock, Azure OpenAI, and Google Agentspace.

Predibase counts enterprises such as Checkr, Marsh McLennan, and Qualcomm among its clients. 

The post Rubrik acquires AI startup Predibase to boost agentic AI offerings  appeared first on CyberScoop.

from CyberScoop https://ift.tt/cjECXWo
via IFTTT

A recently discovered operational relay box (ORB) network controlled by a China-linked threat group already exceeds 1,000 devices and is growing across the United States and East Asia, SecurityScorecard said in a threat report released Monday. 

The ORB network, which SecurityScorecard dubbed “LapDogs,” is primarily composed of routers designed for small or home offices but also includes infected IoT devices, virtual servers and IP cameras. 

Earliest nodes detected by researchers date back to September 2023 and the network has gradually grown since, infecting no more than 60 devices at a time, indicating a highly targeted operation focused on specific locations. Researchers have identified 162 distinct intrusion sets, and more devices are added to the ORB with each intrusion campaign. 

“The expansion rate of LapDogs is going up,” Gilad Maizles, security researcher at SecurityScorecard, said in an email. “Campaigns become more frequent, and with greater yield in numbers, which ultimately leads to more devices added than removed from the network.”

More than one-third of the infections are located in the United States, followed by Japan, South Korea, Taiwan and Hong Kong. Active infections span devices and services from Ruckus Wireless, Asus, Buffalo Technology, Cisco-Linksys, D-Link, Microsoft, Panasonic and Synology. More than half of the compromised devices are Ruckus Wireless access points, according to SecurityScorecard.

“Post-infection activity from this network is still unclear,” Maizles said. “Some ORBs used by China-Nexus actors are shared infrastructure and can host and facilitate more than one intrusion set at once. This makes questions regarding APT motivations, TTPs and post-infection activities much harder to answer. This also ultimately demonstrates how harmful and dangerous ORBs are as an emerging threat within the China-Nexus APT landscape.”

ORB networks are more complicated than botnets, allowing threat groups who control them more stealth capabilities typically used for espionage.

Botnets are similar in that they also ride on a large set of internet-facing devices or virtual services, but “ORB networks are more like Swiss Army knives, and can contribute to any stage of the intrusion lifecycle,” SecurityScorecard researchers said in the report. This includes reconnaissance, anonymized browsing, network traffic data collection for port and vulnerability scanning, node reconfiguration and relaying stolen data upstream. 

Mandiant Intelligence previously chronicled China state-sponsored threat groups’ growing use of ORB networks as a low-effort exercise designed to “create a constantly evolving mesh network that can be used to conceal espionage operations.” 

ORB networks chip away at the notion of attacker-controlled architecture and because they cycle through network infrastructure on a monthly basis. Mandiant researchers warn that the elimination of indicators of compromise is accelerating, because these operational characteristics of ORB networks make it harder for threat researchers to spot and attribute unusual activity on infected nodes. 

The number of devices infected by LapDogs is smaller than other ORBs, but that is likely due to a deliberate decision by the threat group operating the ORB, Maizles said. 

“We speculate that it is an attempt to keep the ORB under the radar and successfully so for the past two years,” he said. “LapDogs could be utilized for long-term, covert and localized operations, which can carry much greater impact on any given organization, rather than widespread infections.”

The post Stealth China-linked ORB network gaining footholds in US, East Asia appeared first on CyberScoop.

from CyberScoop https://ift.tt/wKkRCds
via IFTTT