Full Report
Dive into the recent Las Vegas casino cyberattacks linked to Scattered Spider, and learn how organizations can defend against such identify-based attacks.
Analysis Summary
# Incident Report: Las Vegas Casino Identity-Based Attacks
## Executive Summary
In September 2023, major hospitality and entertainment entities MGM Resorts and Caesars Entertainment were targeted by the threat actor "Scattered Spider" (linked to ALPHV/BlackCat ransomware). The attacks leveraged sophisticated social engineering to compromise employee identities, leading to massive operational disruption at MGM and a significant data breach at Caesars. While Caesars reportedly paid a ransom to avoid disruption, MGM suffered prolonged system outages affecting hotel and casino operations.
## Incident Details
- **Discovery Date:** September 10, 2023 (MGM); Prior to September 7, 2023 (Caesars)
- **Incident Date:** August – September 2023
- **Affected Organization:** MGM Resorts; Caesars Entertainment
- **Sector:** Hospitality / Gaming / Entertainment
- **Geography:** Las Vegas, Nevada, USA
## Timeline of Events
### Initial Access
- **Date/Time:** Early September 2023 (MGM); Late August 2023 (Caesars)
- **Vector:** Social Engineering / Vishing (Voice Phishing)
- **Details:** Attackers contacted IT help desks impersonating employees. They used information gathered from LinkedIn to bypass security questions, convincing IT staff to reset passwords or Multi-Factor Authentication (MFA) tokens.
### Lateral Movement
- Once inside, attackers targeted Okta tenants and Azure Active Directory. They moved laterally across the network by compromising highly privileged administrator accounts.
### Data Exfiltration/Impact
- **Caesars:** Significant volumes of loyalty program data (social security numbers/driver's licenses) were exfiltrated.
- **MGM:** Deployment of ALPHV/BlackCat ransomware led to the encryption of servers, shutting down hotel reservation systems, digital room keys, slot machines, and ATMs.
### Detection & Response
- **MGM:** Detected via widespread system failure on September 10; the company took systems offline to contain the spread.
- **Caesars:** Identified the breach in late August; filed an 8-K with the SEC on September 7, 2023, disclosing the payment of a ransom to prevent public data release.
## Attack Methodology
- **Initial Access:** Vishing and SMS phishing (smishing) to harvest credentials.
- **Persistence:** Registration of new MFA devices and creation of new user accounts in cloud identity providers (Okta/Azure).
- **Privilege Escalation:** Compromise of IT Help Desk accounts to gain administrative control over identity management systems.
- **Defense Evasion:** Use of legitimate Remote Monitoring and Management (RMM) tools to blend in with normal IT traffic.
- **Credential Access:** Credential harvesting via fake login portals and session token theft.
- **Discovery:** Enumeration of active directory structures and cloud environments.
- **Lateral Movement:** Pivoting from compromised user workstations to cloud identity infrastructure.
- **Collection:** Targeting of databases containing PII (Personally Identifiable Information).
- **Exfiltration:** Transfer of sensitive customer data to attacker-controlled storage.
- **Impact:** Strategic encryption of critical infrastructure (MGM) and extortion via data theft (Caesars).
## Impact Assessment
- **Financial:** MGM reported a $100 million negative hit to EBITDAR; Caesars paid approximately $15 million in ransom.
- **Data Breach:** Compromise of millions of customer loyalty records (PII).
- **Operational:** MGM experienced over a week of total operational paralysis (manual check-ins, casino floor shutdowns).
- **Reputational:** High-profile news coverage and loss of consumer trust in the security of large-scale hospitality brands.
## Indicators of Compromise
- **Network:** Access from known proxy services or commercial VPNs (e.g., Mullvad) often associated with Scattered Spider.
- **Behavioral:** Sudden MFA device registration for long-standing employees; unusual login locations; IT help desk password resets followed by immediate access to sensitive data stores.
- **File:** Presence of legitimate RMM tools (AnyDesk, ScreenConnect) in unauthorized segments of the network.
## Response Actions
- **Containment:** MGM shut down entire portions of their network to halt ransomware propagation.
- **Eradication:** Revocation of compromised Okta sessions and global password resets.
- **Recovery:** Restoration of services from backups (MGM); monitoring of Dark Web for leaked data (Caesars).
## Lessons Learned
- **Identity is the Perimeter:** Traditional network defenses are ineffective if the attacker has valid credentials.
- **Human Vulnerability:** Highly trained IT staff remain the weakest link when targeted by skilled social engineers.
- **MFA is Not a Silver Bullet:** Attackers can bypass MFA through "MFA fatigue" attacks or by convincing help desk staff to register new devices.
## Recommendations
- **Strict Verification:** Implement "out-of-band" verification for all IT help desk requests (e.g., requiring a manager's approval for MFA resets).
- **Phishing-Resistant MFA:** Transition to FIDO2-compliant hardware keys (like YubiKeys) to prevent credential harvesting.
- **Identity Monitoring:** Implement automated alerts for suspicious changes in identity provider configurations (Okta/Azure AD).
- **Least Privilege:** Enforce strict Tiered Administration models to ensure help desk accounts cannot modify high-level global administrator settings.