Scourge · September 10 2023

The Scourge of MGM, When the House Lost

Chronicle

On Sunday 10 September 2023 the group known as Scattered Spider, an ALPHV/BlackCat affiliate, encrypted more than a hundred of MGM Resorts' ESXi hypervisors. They had got in with a call to the IT help desk, posing as an employee to get credentials reset. For about ten days slot machines, room keys and booking systems failed across MGM's casinos, and guests queued for physical keys. The company estimated an impact of about $100 million.

Lesson learned

It showed that the help desk is a front door and that verifying who is calling is worth as much as any firewall. It also showed the danger of concentrating everything on a few hypervisors.

Prayer of reparation

O Scattered Spider, who spins webs over the phone, let our help desks always ask for one more proof, and let the house, at least in the server room, never lose. Amen.

How it is remembered

Remembered with strict identity checks at the help desk, phishing-resistant authentication for administrators and hypervisor backups kept out of their reach.