Theresa Payton | FBI issues warning to public as Scattered Spider cyber attacks ramp up

Cyber Security Expert Theresa Payton joins Bo and Beth to discuss the latest announcement by the FBI regarding prompts to change your password after a string of cyber attacks by Scattered Spider.

See omnystudio.com/listener for privacy information.

Episode Transcript

Speaker 1 (00:00):
This is Good Morning BT.

Speaker 2 (00:05):
Newstalk eleven ten wbt boeen Beth on a Friday morning.
Yeah it's Friday, it's not Wednesday, but we are going
to bring on a Wednesday staple on a Friday to
make a cameo because this happens every once in a
while that we need her. What she's here to talk
about doesn't happen every once in a while, which is
exactly why we need her. The FBI is putting an

(00:29):
alert out there this morning, the Federal Bureau of Investigation
and the Cybersecurity and Infrastructure Security Agency updating a joint
cybersecurity advisory about passwords, a critical new warning. Don't reset
your passwords.

Speaker 1 (00:44):
Don't reset your password. It's the thing I've never heard.
I always here reset your password if there's an issue.
But this is a brand new thing, and it's because
of a cybersecurity I guess hacking that they're calling scattered Spider.

Speaker 2 (00:59):
You weren't here last time I talked to Teresa about this,
but we have talked about scattered spider, and scattered Spider
is something that Teresa put on people's radar. I don't
know that we knew it would come back around like
this this quickly Teresa, good morning.

Speaker 3 (01:13):
Good morning. It's great to be with you both. But
why is it always bad news?

Speaker 1 (01:20):
Well, it seems with tech headlines these days, all of
us are so worried about our personal information and our
security and our safety, and it just seems to get
harder and harder and harder to know what to do.

Speaker 3 (01:32):
Yeah, it does. And first of all, kudos to the
Public Service Announcement Office at the FBI because they got
everybody's attention on this by saying, don't reset your passwords,
and everybody's like, wait, why would they say that after
a decade of saying reset your passwords? And so it's
great because it makes everybody stop and say why would
they say that. Here's why Scattered Spider, which has been

(01:55):
around and you write boat. They actually arrested the ringly
of Scattered Spider, Tyler Buchanan in twenty twenty four. But
the group is back. They might have some loose affiliation
with Russia, but this group's a little different. It's actually
young people from the US and UK teens and twenty somethings.

(02:17):
And here's what they're doing. They're either pretending to be
your IT help desk and calling you Beth and Bow
and saying I need you to reset your password, and
then they might say something like you're going to get
a code, tell me what the code is, because I
want to make sure everything went through. And they're really
slick about it because a lot of people say, well
I would know that's not done. But remember these are

(02:38):
UK in English, so the accent is going to be
a certain way they're going to understand culture. They've done
all their homework on social media and so they're very,
very convincing. Also the reverse, they might look up everything
they can find about death and Bo and call the
WBT help desk and say, hey, this is Beth. I'm

(02:58):
locked out of my account. Please help me. I've got
a radio show coming up and I got to get
to my notes. And because we're all wired to be
helpful people, someone might get tricked into doing it. And
it's happening to airlines, it's happening all over the place.
So this is why the FBI had this headline of
don't reset your passwords, because they just want people to pause,

(03:20):
take a moment and saying can say, hey, look, if
I'm initiating the password reset, absolutely go ahead and do
it Beth and bo and for people listening out there.
But if you're getting a text, you're getting a call,
you're getting an email saying reset your password, don't do
it because it's most likely scattered spider.

Speaker 1 (03:38):
So and maybe this is a simple question, but what
what ultimately is the goal of hackers that are creating
something like this. Is it literally just selling personal information
on the dark web? Is it or is it credit
card fraud? Is it you accessing bank records? Is it
all of the above?

Speaker 3 (03:59):
It looks like it's all of the above. If basically
it's like we'll take whatever we can get, but it's
more sinister for companies. So for example, they've been taking
people's frequent fire numbers, they're frequent hotel you know, and
I guess going on vacation or reselling it or whatever
they're doing with it. So that's kind of like at
the lower level the identity theft, they're taking over your miles,

(04:21):
that taking over getting free plane tickets and things like that.
But at the higher level, they're actually getting into companies
and tricking their way in so they you know, if
they get in as somebody who's in to givement resources,
now they can look at the personnel records. There's an
identity theft play. But then there's a well, now I
have an HR account. Now I can reach out to
all the employees there and tell them I've got bonus information.

(04:44):
Now I'm inside, you know, sort of the security walls
of the outside, and people think I'm in HR because
I've hijacked their account. Now they're clicking on my links.
Now I'm infecting more systems, and now I'm taking over
more accounts until I can get to the system and
actually do a ransomware campaign. So we've actually seen it

(05:04):
go as small as identity theft and stealing people's frequent
airline points, and believe me, that's big in our personal lives,
but all the way from that end, which is tragic
and hard to deal with, all the way to ransomware.

Speaker 2 (05:19):
You know, we've entered the era, unfortunately, of scams or
security breaches that are triggered under the guise of security. Yeah. Right,
Because there's this example about changing your passwords. I saw
one the other day that was related to, hey, your
account has been accessed by an unknown user, or you know,

(05:42):
like when you're logging in, for example, to a streaming service.
Or you're logging into an Apple site and you get
a note that says, hey, this site was just accessed
by an unknown computer or a computer that's not known
to your inner circle. Like, I feel like that might
be the next sort of area that they go after.
But we're now in that place where people are reeling

(06:06):
you in and getting you because they're making you think
that you're actually making your security tighter.

Speaker 3 (06:12):
Yeah. The one thing that I tell people to do
because I got a really convincing one to attend a webinar.
On the webinar was going to be on topics that
would matter to me. It looked like a legitimate company,
and I'm looking at it and I just, I don't know,
it felt a little off to me. So before I

(06:32):
hovered on the email domain, which is what gave it
away that it was a complete scam and they were
trying to probably get me to click on a link
to infect my email, I took the body of the
email and I cut and pasted it into a search
engine and then I put COMMA, is this a scam?
And then all these different people had reported, like on Reddit,

(06:55):
different places like don't click on the link to this webinar?
It's going to infect your computer, et cetera, et cetera.
So there's some things that we can all do, you know,
so if something feels a little off, you can do that.
You can go to the free toolvirustotal dot com. Another
thing to watch out for too bo Like let's say
that convinced you to click on a link, because sometimes

(07:15):
those are legit and you do have to do something
or protect your account. Let's say it did convince you
to click on a link, but now all of a sudden,
you're in this like weird do loop for your multi
factor authentication where it's like, no, try this code, No,
try that code, No, that didn't work. That is a
red flag. And I always tell people one of the
best things you can do is to break the cycle

(07:36):
is just shut down all of your devices and come
back in, come back and clean, maybe go to another
device and log into everything very slowly, methodically, breathe, think,
and you're most likely going to be okay because you
broke that link between you and the attacker trying to
figure out how to get into your account.

Speaker 2 (07:56):
So again, just to wrap up here, the FBI warning
would guarding passwords is that if you get solicited to
change your password. And it doesn't seem like it fits,
like you didn't start it, or it's not anywhere near
something that you started the process on, then you need
to be leery of that and don't it's not And
we're not saying don't ever change your password. Of course,

(08:17):
change your password, like Teresa has already always told us,
but don't be very suspicious if you get a prompt
that that comes.

Speaker 1 (08:26):
Out of nowhere, and really quickly. Teresa, we just got
a text message to our text line from Roland who said,
good morning. I got that email saying it was from
HR about bonus pay. I clicked it. It looked official.
They sent an email to all of my contacts saying
it was from me and to pay an invoice, and
from there they got to his personal information and then

(08:47):
hacked into a credit card. So he said, be careful
people out there, because for him it looked like it
was from the HR department from his company.

Speaker 3 (08:55):
Oh my gosh, yps. So these are the red flags,
and I appreciate him sharing. That's anario that happened to him.
And gosh, our time together goes by so fast. I
know you guys have other topics to cover. Thanks for
having me on, and everybody be safe out there.