MGM and Caesars: How Teenagers With a Phone Brought Down Two Casino Empires

2026-08-09-18 min read

#scattered-spider#mgm#caesars#unc3944#alphv#blackcat#vishing#okta#ransomware#social-engineering#helpdesk

In September 2023, two of the largest casino and hotel companies in the world were compromised within days of each other. Caesars Entertainment paid a ransom of approximately $15 million to the attackers before the breach became public. MGM Resorts refused to pay and spent ten days watching its operations collapse: slot machines went dark, hotel room keys stopped working, restaurant POS systems went offline, and reservation systems were unavailable across its portfolio of 30+ Las Vegas properties. MGM's total losses from the incident exceeded $100 million.

Both attacks were carried out by Scattered Spider, also known as UNC3944, Starfraud, and Muddled Libra - a loosely organized cybercriminal group whose members were primarily English-speaking teenagers and young adults, most from the US and UK. The group's specialty was vishing (voice phishing) and social engineering of IT helpdesk systems. They did not use novel zero-day exploits; they called helpdesks, impersonated employees, and talked their way into access. The MGM attack started with a ten-minute LinkedIn search and a single phone call.

The Helpdesk Call That Brought Down MGM

Scattered Spider identified an MGM IT employee on LinkedIn, obtained enough personal information about him to impersonate him convincingly, then called MGM's IT helpdesk. The call lasted approximately ten minutes. The caller claimed to be the employee, said they had lost access to their multi-factor authentication app, and asked for their MFA to be reset. The helpdesk complied.

This provided the attackers with valid credentials and bypassed MFA for an Okta superadministrator account - a privileged identity that had access to all of MGM's identity infrastructure. From there, the attackers moved into MGM's Azure environment, escalated privileges, and ultimately deployed ALPHV (BlackCat) ransomware across critical systems. The entire escalation path from initial access to ransomware deployment took less than 24 hours.

MGM detected the attack and chose to shut down systems rather than pay a ransom. This decision prevented further data exfiltration but triggered the operational disruption: systems that were taken offline to contain the ransomware included the hotel management systems, slot machine networks, and POS infrastructure that kept the properties running. At peak disruption, MGM's Las Vegas properties were operating with manual processes - cash-only transactions, paper records, physical key overrides.

[TECHNICAL NOTE]

Scattered Spider's access to MGM used a classic identity attack chain that bypassed MGM's technical security controls entirely. The sequence: (1) OSINT on LinkedIn to identify a real employee with a plausible reason to contact IT; (2) vishing the helpdesk with enough personal detail to pass identity verification; (3) MFA reset gives valid session to Okta superadmin; (4) Okta superadmin creates new identities or grants access in Azure AD; (5) lateral movement through cloud infrastructure using legitimate admin tools; (6) ALPHV ransomware affiliate deploys via legitimate admin channels. At no point did the attacker exploit a software vulnerability. Every step used legitimate authentication credentials obtained through social engineering. This attack pattern is increasingly common and increasingly effective because organizations have invested heavily in technical security while under-investing in helpdesk security procedures and identity verification.

Caesars: Pay the Ransom, Tell Nobody

Caesars Entertainment was compromised before MGM, using similar social engineering methods - a third-party IT vendor's helpdesk was the initial target rather than Caesars' internal IT. The attackers obtained access to Caesars' network and exfiltrated data from the loyalty program database, which contained information on tens of millions of members.

Caesars negotiated a ransom payment, reportedly paying approximately $15 million (half of the initially demanded $30 million). The payment was made before any public disclosure. Caesars disclosed the breach in an SEC filing on September 14, 2023 - the same day as MGM's disclosures - but the disclosure was carefully worded to minimize alarm. The company stated it "could not guarantee" that the stolen data would not be further disclosed, an acknowledgment that ransom payment does not guarantee data deletion.

The contrast between the two companies' approaches - Caesars paying quietly, MGM refusing and absorbing operational catastrophe - became a case study in ransomware response strategy. Neither outcome was clearly superior: Caesars avoided operational disruption but paid $15M with no guarantee of data security; MGM avoided paying but absorbed $100M+ in losses and ten days of operational chaos.

[WARNING]

The MGM and Caesars attacks occurred after the SEC's new cybersecurity disclosure rules took effect, requiring public companies to report material cybersecurity incidents within four business days. Both companies' disclosures were among the first major tests of the new rules. The SEC rules create a tension: rapid public disclosure allows affected parties (customers, partners) to protect themselves, but may provide attackers with information about response efforts and remaining access. The rules also create legal liability for executives who knowingly certify inaccurate security disclosures - a meaningful shift from the previous environment where breach disclosure timing was largely discretionary.

Who Is Scattered Spider?

Scattered Spider is not a traditional criminal organization with a fixed membership and hierarchical structure. It is a community of individuals who share techniques and collaborate on operations through Telegram and other channels. Members are typically 17-25 years old, native English speakers, and experts in social engineering and identity attacks. Many had backgrounds in SIM swapping before evolving toward corporate ransomware operations.

The FBI identified and arrested several Scattered Spider members in 2023 and 2024. Noah Urban (19, Florida), arrested November 2023. Tyler Buchanan (22, Scotland), arrested June 2024 in Spain. Ahmed Elbadawy (23, Texas), arrested November 2023. Remington Ogletree (19, Florida), arrested November 2023. The arrests disrupted some operations but did not eliminate the community.

Scattered Spider's operations were notable for targeting critical US infrastructure - Las Vegas casinos, but also telecommunications companies (T-Mobile was an earlier target), healthcare organizations, and financial services firms. The FBI and CISA issued a joint advisory in November 2023 detailing Scattered Spider TTPs and indicators, an unusual acknowledgment of a primarily domestic criminal threat actor.

The ALPHV Partnership

Scattered Spider did not build the ransomware they deployed - they were affiliates of the ALPHV (BlackCat) ransomware-as-a-service program. This reflected the broader ransomware ecosystem: specialized groups provide ransomware infrastructure on a profit-sharing basis, while affiliates handle initial access and deployment. Scattered Spider's specialty (English-language social engineering of corporate helpdesks) combined with ALPHV's ransomware platform created a particularly effective combination against large US corporations.

ALPHV itself was disrupted by a joint FBI/international law enforcement operation in December 2023 - three months after the MGM attack. The operation seized ALPHV infrastructure and obtained decryption keys. ALPHV subsequently exit-scammed its own affiliates, claiming law enforcement had seized their payment portal (which had actually been seized), and took the remaining funds. The ecosystem disruption was significant but temporary - former ALPHV affiliates migrated to other ransomware platforms.

[IOC]

Scattered Spider TTPs (from CISA/FBI Advisory AA23-320A, November 2023): initial access via vishing IT helpdesks with OSINT-sourced employee details; targeting Okta, Azure AD, and other identity platforms for privilege escalation; use of legitimate remote monitoring tools (AnyDesk, TeamViewer, Splashtop) for persistence to avoid detection; SIM swapping to bypass SMS-based MFA; use of residential proxies to obscure traffic origin. Detection: anomalous Okta admin activity outside normal hours; new MFA device enrollments not initiated by the account owner; identity provider alerts for account modification; helpdesk tickets requesting MFA reset followed by immediate login from new device/location. Defenses: require callback verification for MFA resets using a number on file, not one provided by the caller; require manager approval for helpdesk-initiated MFA changes; implement phishing-resistant MFA (FIDO2/WebAuthn hardware keys) for privileged accounts; helpdesk staff training on social engineering recognition.