MailChimp的

2023年2月6日

據TechCrunch獲得的一份報告顯示，去年攻擊了130多家機構並竊取了近萬名員工的證書的黑客，目前仍在瞄準幾家科技和視頻遊戲公司。這份由網絡安全公司CrowdStrike編寫的報告稱這些黑客為“分散的蜘蛛”。在之前的一份公開報告中，該公司稱這個群體也被稱為“roast 0ktapus”，這顯然是指另一家網絡安全公司group - ib去年發布的報告。TechCrunch獲得的這類報告是由威脅情報公司為客戶準備的，目的是提醒客戶，黑客要麼直接針對客戶，要麼針對同一行業的其他公司。在報告中，CrowdStrike指出，由於沒有“額外的取證文物”(指直接從目標組織獲得的數據)，他們對黑客活動的可見性有限。這就是為什麼該公司承認，它對這是Scattered Spider的活動的評估“信心不足”。兩名不願透露姓名的網絡安全業內人士表示，據業內人士了解，Scattered Spider和0ktapus是同一個團隊。“Scattered Spider在2023年1月繼續部署大量釣魚頁麵。據CrowdStrike Intelligence評估，對手可能已經擴大了目標範圍，包括專門從事遊戲或金融軟件的技術部門公司，同時保持先前對業務流程外包(BPO)公司和手機提供商的關注。”目前還不清楚這是否是上個月入侵Riot Games的同一個組織，但在CrowdStrike報告中包含的釣魚域名列表中，有一個域名顯然是針對視頻遊戲巨頭的，因為它在URL中包含了該公司的名稱。 Among the phishing domains, there’s also others tailored to impersonate video game makers Roblox and Zynga, email marketing and newsletter giant Mailchimp and its parent company Intuit, Salesforce, Comcast, and Grubhub. TaskUs, a contractor that provides customer service for companies, including Mailchimp, Intuit and other tech giants, was also on the list. In January, Mailchimp disclosed that it had been hacked — the second hack against the company in six months. At the time, Mailchimp said the hackers targeted its employees via phishing. It’s unclear if this incident is tied to the activities of Scattered Spider. Mailchimp did not respond to a request for comment. Riot declined to comment. Salesforce spokesperson Allen Tsai said that the company is “aware of and monitor phishing campaigns industry-wide.” “At this time, we have no indication of unauthorized access to customer data relevant to the cited report,” Tsai said in an email. An Intuit spokesperson did not comment as they had not seen the report. Roblox, Zynga, TaskUs, Comcast and Grubhub did not immediately respond to a request for comment. The report said that “the majority” of the hacking group’s phishing pages were designed to mimic Okta login portals, “while a much smaller number impersonated Microsoft.” CrowdStrike did not respond to a request for comment. Are you a Google Fi subscriber that was also a victim of a similar attack? Did you also get a personalized notification from the company about the hack against you? We’d love to hear from you. You can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Wickr, Telegram and Wire @lorenzofb, or email lorenzo@techcrunch.com . You can also contact TechCrunch via SecureDrop .