Infamous cyberattackers claim their next shocking victim — using a decades-old trick

In 2023, a hacking group called Scattered Spider executed an unprecedented hit on Las Vegas, using a relatively simple yet shockingly effective technique. Now, group members are the prime suspects in another shockingly high-profile cyberattack.

The group attacked MGM casinos in 2023, seemingly gaining access after phishing for credentials. In response, the Bellagio, Aria, Cosmopolitan, and Excalibur casinos shut down large parts of their networks after the breach was discovered in an attempt to cordon off the access.

The FBI has warned about these scams since 2007.

“Slot machines stopped working, electronic transfers of winnings slowed down, and key cards for thousands of hotel rooms no longer functioned,” Ars Technica wrote at the time.

Later that same year, Caesars Entertainment described a social engineering attack that led to data theft from its customer rewards program.

An outsourced IT support vendor provided unauthorized access, and the breach wasn’t discovered for weeks.

Now, that same method, called “vishing,” has been used to penetrate another massive target: Wall Street.

Several major Wall Street firms faced the attacks, which use Voice over Internet Protocol (VoIP) calls. The problem is that the technique, which became possible some 20 years ago, is pretty much immune to any cybersecurity measures the affected funds are able to implement. In fact, the basic idea behind the exploit goes back some 50 years to when early hackers used “phone phreaking” to coax key info from unsuspecting targets.

RELATED: This throwback app is competing with Big Tech — using a business model out of the 1980s

Zak Bennett/Bloomberg/Getty Images

Among the attacked firms was Citadel, the financial services company that manages over $70 billion in assets. While Citadel has not publicly offered any inside information on what happened, another firm that was attacked, Point72 Asset Management, offered some bread crumbs by saying no customer information was stolen, per Reuters.

Two Sigma, the private hedge fund responsible for $75 billion in assets, provided the most detail when it said it caught the attempt before any information was compromised.

“Our security team responded quickly to an attempted vishing campaign targeting Two Sigma and other investment managers, and we have no indication of any impact to our data or our systems,” a spokesperson said, according to Briefs Finance.

Scattered Spider has been linked to Russian-speaking hackers called AlphV/BlackCat, using VoIP calls to trick IT workers into bypassing multifactor authentication.

Employees can relatively easily be tricked into granting access or providing login information to major institutions and chains.

The phone-call tactic is still widely used due to its effectiveness.

RELATED: Is this the number-crunchers’ come-to-Jesus moment?

Emile Wamsteker/Bloomberg/Getty Images

The FBI has warned about these scams since 2007, warning citizens to answer “vishing” attempts at accessing their personal information “with a healthy dose of skepticism.”

Businesses are warning of “social engineering” as a practice of manipulation that can affect gatekeepers of sensitive information.

Cloudflare has categorized these phone-call breach attempts along the same lines as a fake delivery truck driver or a cyber attack. In most cases, these attacks aim to get the victim to divulge either login credentials or sensitive financial information.

Like Blaze News? Bypass the censors, sign up for our newsletters, and get stories like this direct to your inbox. Sign up here!