FlagThis - #security

Scattered Spider, a financially motivated cyber threat group, has significantly expanded its targeting, with recent intelligence highlighting a new focus on the aviation sector. Known for its aggressive social engineering tactics and identity-focused intrusions, the group has previously targeted telecommunications, SaaS, cloud, and financial services by hijacking user identities and exploiting authentication flows. The FBI has issued a warning, indicating that airlines are now directly in the crosshairs of Scattered Spider. Their methods often involve sophisticated techniques such as SIM swapping, impersonating helpdesk personnel, and employing adversary-in-the-middle (AiTM) phishing to obtain valid credentials and tokens, frequently bypassing multi-factor authentication (MFA). This broader targeting strategy underscores the evolving and increasingly pervasive threat posed by this group.

In a significant development that underscores the reach of Scattered Spider, UK authorities have arrested four individuals linked to a spree of cyberattacks that crippled major British retailers, including Marks & Spencer, Harrods, and the Co-op earlier this year. The arrests, which involved individuals aged 17 to 20, are a major step in a high-priority investigation. The National Crime Agency (NCA) confirmed the arrests, suspecting the individuals of Computer Misuse Act offenses, blackmail, money laundering, and participation in organized crime. These retail attacks caused substantial disruption, with Marks & Spencer estimating losses of around £300 million due to the incident. The methods employed in these attacks, which reportedly included gaining access through social engineering to deploy ransomware, align with Scattered Spider's known modus operandi.

The growing threat posed by Scattered Spider has prompted cybersecurity experts to issue alerts, particularly concerning their expansion into the aviation sector. The group's ability to effectively compromise user identities and bypass security measures like MFA makes them a formidable adversary. Their recent targeting of airlines, following major disruptions in the retail sector, signifies a dangerous escalation. Companies within the aviation industry, and indeed across all sectors, must remain vigilant and bolster their identity-centric defenses to counter the sophisticated tactics employed by Scattered Spider, which include advanced phishing kits, dynamic command and control infrastructure, and custom malware for persistent access.


References :

• blog.checkpoint.com: Exposing Scattered Spider: New Indicators Highlight Growing Threat to Enterprises and Aviation
• Resources-2: Tracking Scattered Spider Through Identity Attacks and Token Theft
• Cloud Security Alliance: Scattered Spider: The Group Behind Major ESXi Ransomware Attacks
• BrianKrebs: You've probably read by now that British authorities this week arrested 4 people aged 17-20 in re an investigation into data ransom attacks from the cybercrime group Scattered Spider, which has been blamed in breaches at Marks & Spencer, Harrods, MGM Casinos and a bunch of airlines recently.
• infosec.exchange: 3 teenagers aged 17-19 and a 20-year-old woman arrested in the UK this morning in connection with cyber attacks on Marks & Spencer (M&S) and Co-op retail chains in April-May this year
• Zack Whittaker: New, by me: U.K. authorities have confirmed the arrest of four alleged hackers behind the recent U.K. retail hacking spree targeting Marks & Spencer, Harrods, and the Co-op earlier this year. The hackers are allegedly linked to Scattered Spider; one of the suspects is aged 17.
• techcrunch.com: The U.K. National Crime Agency said the suspects are in custody in relation to the hacks targeting Marks & Spencer, Harrods, and the Co-op.
• SecureWorld News: 4 Arrested in U.K. for Cyberattacks on Retail Tied to Scattered Spider
• techcrunch.com: The U.K. National Crime Agency said the suspects are in custody in relation to the hacks targeting Marks & Spencer, Harrods, and the Co-op.
• www.nationalcrimeagency.gov.uk: Report on the arrests of four individuals linked to the Scattered Spider hacking group for the cyberattacks on UK retailers.
• The Register - Security: NCA arrests four in connection with UK retail ransomware attacks
• krebsonsecurity.com: You've probably read by now that British authorities this week arrested 4 people aged 17-20 in re an investigation into data ransom attacks from the cybercrime group Scattered Spider, which has been blamed in breaches at Marks & Spencer, Harrods, MGM Casinos and a bunch of airlines recently.
• thecyberexpress.com: UK NCA Arrests Four in Cyberattacks on M&S, Co-op, and Harrods
• HYPR Blog: Deconstructing the Gen-Z Hackers behind the £440M Cyber Attack on Marks & Spencer, Co-op, and Harrods
• cyberscoop.com: UK arrests four for cyberattacks on major British retailers
• Threats | CyberScoop: UK arrests four for cyberattacks on major British retailers
• WIRED: 4 Arrested Over Scattered Spider Hacking Spree
• blog.knowbe4.com: Alert from KnowBe4 about Scattered Spider targeting the aviation sector.
• Metacurity: UK's NCA arrested four people for M&S, Co-Op cyberattacks
• Risky.Biz: Four Key Players Drive Scattered Spider
• Talkback Resources: UK charges four in Scattered Spider ransom group
• TechInformed: Four people have been arrested as part of a National Crime Agency (NCA) investigation into cyberattacks targeting major UK retailers M&S, Harrods and Co-op.
• Help Net Security: The UK's National Crime Agency (NCA) arrested four individuals suspected of being involved in cyberattacks on major retailers in the country, including Marks & Spencer, Co-op, and Harrods.
• hackread.com: UK Arrests Woman and Three Men for Cyberattacks on M&S Co-op and Harrods
• securityaffairs.com: UK NCA arrested four people over M&S, Co-op cyberattacks
• BleepingComputer: The UK's National Crime Agency (NCA) arrested four people suspected of being involved in cyberattacks on major retailers in the country, including Marks & Spencer, Co-op, and Harrods.

Classification:

• HashTags: #scatteredspider #socialengineering #identitytheft
• Company: Pic Security
• Target: telecom, SaaS, cloud, financial services, and aviation
• Attacker: Scattered Spider
• Product: telecom services
• Feature: social engineering
• Malware: AiTM phishing
• Type: Hack
• Severity: Major

McDonald's has been at the center of a significant data security incident involving its AI-powered hiring tool, Olivia. The vulnerability, discovered by security researchers, allowed unauthorized access to the personal information of approximately 64 million job applicants. This breach was attributed to a shockingly basic security flaw: the AI hiring platform's administrator account was protected by the default password "123456." This weak credential meant that malicious actors could potentially gain access to sensitive applicant data, including chat logs containing personal details, by simply guessing the username and password. The incident raises serious concerns about the security measures in place for AI-driven recruitment processes.

The McHire platform, which is utilized by a vast majority of McDonald's franchisees to streamline the recruitment process, collects a wide range of applicant information. Researchers were able to access chat logs and personal data, such as names, email addresses, phone numbers, and even home addresses, by exploiting the weak password and an additional vulnerability in an internal API. This means that millions of individuals who applied for positions at McDonald's may have had their private information compromised. The ease with which this access was gained highlights a critical oversight in the implementation of the AI hiring system, underscoring the risks associated with inadequate security practices when handling large volumes of sensitive personal data.

While the security vulnerability has reportedly been fixed, and there are no known instances of the exposed data being misused, the incident serves as a stark reminder of the potential consequences of weak security protocols, particularly with third-party vendors. The responsibility for maintaining robust cybersecurity standards falls on both the companies utilizing these technologies and the vendors providing them. This breach emphasizes the need for rigorous security testing and the implementation of strong, unique passwords and multi-factor authentication to protect applicant data from falling into the wrong hands. Companies employing AI in sensitive processes like hiring must prioritize data security to maintain the trust of job seekers and prevent future breaches.


References :

• Talkback Resources: Leaking 64 million McDonald’s job applications
• Security Latest: McDonald’s AI Hiring Bot Exposed Millions of Applicants' Data to Hackers Using the Password ‘123456’
• Malwarebytes: The job applicants' personal information could be accessed by simply guessing a username and using the password “12345.â€
• www.wired.com: McDonald’s AI Hiring Bot Exposed Millions of Applicants' Data to Hackers Using the Password ‘123456’
• www.pandasecurity.com: Yes, it was. The personal information of approximately 64 million McDonald’s applicants was left unprotected due to login details consisting of a username and password…
• Cybersecurity Blog: McDonald's Hiring Bot Blunder: AI, Fries and a Side of Job Seeker Data
• techcrunch.com: AI chatbot’s simple ‘123456’ password risked exposing personal data of millions of McDonald’s job applicants
• www.pandasecurity.com: Was the data of 64 million McDonald’s applicants left protected only by a flimsy password?
• Talkback Resources: McDonald’s job app exposes data of 64 Million applicants
• hackread.com: McDonald’s AI Hiring Tool McHire Leaked Data of 64 Million Job Seekers
• futurism.com: McDonald’s AI Hiring System Just Leaked Personal Data About Millions of Job Applicants
• hackread.com: Security flaws in McDonald's McHire chatbot exposed over 64 million applicants' data.
• www.csoonline.com: McDonald’s AI hiring tool’s password ‘123456’: Exposes data of 64M applicants
• Palo Alto Networks Blog: The job applicants' personal information could be accessed by simply guessing a username and using the password “123456.
• SmartCompany: Big Hack: How a default password left millions of McDonald’s job applications exposed
• Talkback Resources: '123456' password exposed chats for 64 million McDonald’s job applicants
• databreaches.net: McDonald’s just got a supersized reminder to beef up its digital security after its recruitment platform allegedly exposed the sensitive data of 64 million applicants.
• BleepingComputer: Cybersecurity researchers discovered a vulnerability in McHire, McDonald's chatbot job application platform, that exposed the chats of more than 64 million job applications across the United States.
• PrivacyDigest: McDonald’s Exposed Millions of Applicants' Data to Using the ‘123456’
• www.tomshardware.com: McDonald's McHire bot exposed personal information of 64M people by using '123456' as a password in 2025
• bsky.app: Cybersecurity researchers discovered a vulnerability in McHire, McDonald's chatbot job application platform, that exposed the personal information of more than 64 million job applicants across the United States.
• malware.news: McDonald’s just got a supersized reminder to beef up its digital security after its recruitment platform allegedly exposed the sensitive data of 64 million applicants.

Classification:

• HashTags: #DataBreach #CyberSecurity #AIsecurity
• Company: McDonald's, Paradox.ai
• Target: McDonald's job applicants
• Product: Olivia
• Feature: AI Hiring
• Malware: Olivia
• Type: DataBreach
• Severity: Major

Cisco is urging immediate action following the discovery of a critical vulnerability, CVE-2025-20309, in its Unified Communications Manager (Unified CM) and Unified Communications Manager Session Management Edition (Unified CM SME). The flaw stems from hardcoded SSH root credentials that cannot be modified or removed, potentially allowing remote attackers to gain root-level access to affected systems. This vulnerability has a maximum severity rating with a CVSS score of 10.0, indicating it can be easily exploited with devastating consequences.

Cisco's security advisory specifies that all Engineering Special (ES) releases from 15.0.1.13010-1 through 15.0.1.13017-1 are vulnerable, regardless of optional features in use. An unauthenticated remote attacker can exploit this vulnerability by utilizing the static root account credentials to establish SSH connections to vulnerable systems. Once authenticated, the attacker gains complete administrative control over the affected device, enabling the execution of arbitrary commands with root privileges.

There are no temporary workarounds to mitigate this risk. To remediate the vulnerability, administrators are advised to upgrade to version 15SU3 or apply the CSCwp27755 patch. Although Cisco discovered the flaw through internal testing and has not found evidence of active exploitation in the wild, the extreme severity necessitates immediate action to safeguard enterprise communications. The company has issued emergency fixes for the critical root credential flaw in Unified CM.


References :

• MeatMutts: Cisco Urges Immediate Action After Discovering Backdoor in Unified Communications Manager
• infosec.exchange: : Unified Communications Manager systems could allow remote attackers to gain root-level access. The vulnerability CVE-2025-20309 with a maximum CVSS 10.0, stems from hardcoded SSH root credentials that cannot be modified or removed: 👇
• Rescana: Critical Cisco Unified CM Vulnerability: Root Access via Static Credentials – Technical Analysis & Mitigation Strategies
• cybersecuritynews.com: Unified Communications Manager systems could allow remote attackers to gain root-level access. The vulnerability CVE-2025-20309 with a maximum CVSS 10.0, stems from hardcoded SSH root credentials that cannot be modified or removed:
• hackread.com: Cisco Issues Emergency Fix for Critical Root Credential Flaw in Unified CM
• thecyberexpress.com: Cisco Issues Urgent Patch for Critical Unified CM Vulnerability (CVE-2025-20309)
• Arctic Wolf: CVE-2025-20309: Cisco Unified Communications Manager Static SSH Credentials Maximum Severity Vulnerability
• arcticwolf.com: CVE-2025-20309: Cisco Unified Communications Manager Static SSH Credentials Maximum Severity Vulnerability
• sec.cloudapps.cisco.com: Security advisory from Cisco addressing the vulnerability.
• The Register - Security: Cisco scores a perfect 10 - sadly for a critical flaw in its comms platform
• nvd.nist.gov: Details of the Cisco vulnerability CVE-2025-20309.

Classification:

• HashTags: #Cisco #Vulnerability #UnifiedCM
• Company: Cisco
• Target: Cisco Unified CM
• Product: Unified CM
• Feature: Hardcoded Credentials
• Malware: CVE-2025-20309
• Type: Vulnerability
• Severity: Disaster