{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"Daily Security Review","title":"Scattered Spider Strikes Again: Inside the VMware ESXi Ransomware Tactics","html":"","width":"100%","height":180,"duration":3359,"description":"In this episode, we examine the sophisticated operations of Scattered Spider—also known as Muddled Libra, UNC3944, and Octo Tempest—a financially motivated cybercriminal group that has redefined the ransomware threat landscape. Recently highlighted by Google’s Threat Intelligence Group (GTIG), Scattered Spider has escalated its attacks by targeting VMware vSphere and ESXi environments, seizing control of hypervisors to disable backups, steal sensitive data, and deploy ransomware with devastating speed.\nUnlike traditional malware-heavy groups, Scattered Spider relies on meticulous social engineering to gain initial access—tricking IT support staff into resetting credentials and multi-factor authentication tokens. From there, they execute a lightning-fast kill chain:\nEscalating privileges through Active Directory\nGaining administrative control of vCenter\nPivoting to ESXi hypervisors to paralyze entire enterprises\nEncrypting data and backups to maximize leverage in double extortion schemes\nDespite arrests of key members, including links to high-profile attacks on MGM Resorts, Caesars Entertainment, and major financial institutions, Scattered Spider continues to evolve. Their methods expose a dangerous blind spot: EDR tools don’t run on ESXi hypervisors, leaving virtualized infrastructure dangerously under-monitored.\nThis episode unpacks:\nThe attack chain Scattered Spider uses to dominate virtualized environments\nWhy EDR is no longer enough in today’s infrastructure-driven attacks\nHow their partnerships with ransomware-as-a-service (RaaS) groups like ALPHV, DragonForce, and RansomHub amplify their reach\nDefensive strategies for organizations, including Managed XDR, immutable backups, phishing-resistant MFA, and infrastructure-centric monitoring\nWhy businesses must move toward holistic, zero-trust security models that extend beyond the endpoint\nAs Scattered Spider shows, the threat landscape is shifting from endpoints to the very infrastructure that keeps enterprises...","thumbnail_url":"https://img.transistorcdn.com/pL79_MJFeJHamQ_ztImsGmDSMdl27VMk_30TAkieujE/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS8yNzg5/ZjlhNzM5Y2M4Njli/NjkxNzgyODA2Nzhi/MDI2ZC5wbmc.webp","thumbnail_width":300,"thumbnail_height":300}