Hackers associated with “Scattered Spider” tactics have expanded their targeting to the aviation and transportation industries after previously attacking insurance and retail sectors

These threat actors have employed a sector-by-sector approach, initially targeting retail companies, such as M&S and Co-op, in the United Kingdom and the United States and subsequently shifting their focus to insurance companies.

While the threat actors were not officially named as responsible for insurance sector attacks at first, recent incidents have impacted Aflac, Erie Insurance, and Philadelphia Insurance Companies.

Hackers target the aviation industry

On June 12, Canada’s second-largest airline, WestJet, suffered a cyberattack that briefly disrupted the company’s internal services and mobile app.

Soon after the breach, sources told BleepingComputer that Palo Alto Networks and Microsoft were assisting in the response to the attack.

The attack was attributed to Scattered Spider, who allegedly compromised the company’s data centers and its Microsoft Cloud environment.

BleepingComputer was informed that the threat actor gained access by performing a self-service password reset for an employee, which enabled them to register their own MFA and obtain remote access to the network through Citrix.

While other threat actors conduct identity attacks, Scattered Spider has become associated with this tactic due to their regular targeting of help desks and password and MFA infrastructure.

Today, Hawaiian Airlines also disclosed that they suffered a cyberattack but did not provide any details that could indicate who was behind the attack. However, a source told BleepingComputer that it is believed that the same threat actors are responsible.

Palo Alto Networks’ Sam Rubin, SVP of Consulting and Threat Intelligence, has now confirmed on LinkedIn that Scattered Spider has begun targeting the aviation industry.

“Unit 42 has observed Muddled Libra (also known as Scattered Spider) targeting the aviation industry,” warned Rubin.

“Organizations should be on high alert for sophisticated and targeted social engineering attacks and suspicious MFA reset requests.”

Mandiant’s Charles Carmakal also warned that the threat actors have now switched their focus to both the aviation and transportation sectors.

“ALERT: Scattered Spider has added North American airline and transportation organizations to their target list,” Carmakal posted to LinkedIn.

“Mandiant (part of Google Cloud) is aware of multiple incidents in the airline and transportation sector which resemble the operations of UNC3944 or Scattered Spider.

“We recommend that the industry immediately take steps to tighten up their help desk identity verification processes prior to adding new phone numbers to employee/contractor accounts (which can be used by the threat actor to perform self-service password resets), reset passwords, add devices to MFA solutions, or provide employee information (e.g. employee IDs) that could be used for a subsequent social engineering attacks.”

American Airlines is also currently suffering an IT outage but it is unclear if it is a security incident. BleepingComputer contacted the airline but has not received a response.

What is Scattered Spider

Scattered Spider, also known as 0ktapus, Starfraud, UNC3944, Scatter Swine, Octo Tempest, and Muddled Libra, is a classification of threat actors that are adept at using social engineering attacks, phishing, multi-factor authentication (MFA) bombing (targeted MFA fatigue), and SIM swapping to gain initial network access on large organizations.

These threat actors include young English-speaking people with diverse skill sets who frequent the same hacker forums, Telegram channels, and Discord servers. These mediums are then used to plan and execute attacks in real time.

Some are believed to be part of the “Com” – a loose-knit community of threat actors known for financial fraud, cryptocurrency theft, data breaches, and extortion attacks.

While Scattered Spider is commonly referred to as a cohesive gang, it is actually used to denote threat actors who utilize specific tactics when conducting attacks. As attacks associated with Scattered Spider tactics are also commonly used by different individuals from a loose network of threat actors, it makes it difficult to track them.

Unlike many other English-speaking threat actors, those associated with “Scattered Spider” have been known to partner with Russian-speaking ransomware gangs, such as BlackCat, RansomHub, Qilin, and DragonForce.

Other attacks linked to Scattered Spider include those on MGM, Marks & Spencer, Co-op, Twilio, Coinbase, DoorDash, Caesars, MailChimp, Riot Games, and Reddit.

Organizations defending against this type of threat actor should start with gaining complete visibility across the entire infrastructure, identity systems, and critical management services.

This includes securing self-service password reset platforms and help desks, common targets of these threat actors.

Both Google Threat Intelligence Group (GTIG) and Palo Alto Networks have released guides on hardening defenses against the known “Scattered Spider” tactics used by these threat actors.

All admins are advised to familiarize themselves with these tips and harden their identity platforms and processes.

Update 6/27/25: Added that American Airlines is currently suffering from an IT outage.

Many sports fans may know David Tepper as the owner of the NFL’s Carolina Panthers. But in the investing world, Tepper is considered a legend. Between 1993 and 2019, Tepper’s fund, Appaloosa Management, generated compound annual returns of more than 25% per year, net of all fees, according to Institutional Investor. Today, Tepper still runs Appaloosa but as a family office, and he’s still arguably one of the most influential investors in the market. In the first quarter of 2025, filings show that Appaloosa more than halved its position in the artificial intelligence (AI) chip giant Nvidia (NVDA -1.02%), while loading up on a market-beating transportation stock instead.

Reading the tea leaves on Nvidia

Like many stocks in 2025, Nvidia has had an up-and-down year. It sold off intensely but then rebounded and is currently down only 2% for the year. Earlier in 2025, there were many concerning events that could have caused investors to press the sell button.

Image source: Getty Images.

The first occurred after China’s DeepSeek created an artificial intelligence chatbot rivaling OpenAI’s ChatGPT, supposedly at a fraction of the cost and with older Nvidia chips. Now, there’s much dispute about the level of resources that went into DeepSeek but it caused investors to worry about demand for Nvidia’s chips and whether or not more in the AI world could be done with less.

Then there were concerns about export restrictions and how that might impact Nvidia’s business in China. Former President Joe Biden’s administration began to limit the types of chips Nvidia could sell to China, in an effort to prevent China from obtaining semiconductors it could use to build a super computer. Those restrictions ramped up and the Biden administration also tried to close loopholes by preventing Nvidia from selling certain chips to other countries that could then sell them to China. The Trump administration plans to remove some of the Biden-era policies but also implemented its own restrictions that caused Nvidia to take a $5.5 billion charge in the first quarter of the year.

While there is still broader market uncertainty, particularly as U.S. Treasury yields surged, investors seem to have renewed faith in AI demand and Nvidia currently trades at a cheaper forward earnings multiple than earlier this year, so it’s not a bad time for long-term oriented buyers to buy shares or start dollar-cost averaging again.

NVDA PE Ratio (Forward) data by YCharts

A ride-sharing company with autonomous potential

While selling Nvidia, Tepper and Appaloosa more than doubled their position in the ride-sharing company Uber Technologies (UBER -0.16%). Uber was one of the most highly touted start-ups, but struggled to turn a profit for many years. In 2017, the company brought on Dara Khosrowshahi, who has focused less on growth and more on improving operations.

Through a mixture of cost-cutting, price increases, exiting difficult markets like China, and a focus on growing profitable businesses like Uber Eats, Uber managed to turn its first profit in 2023. Since then, profits and revenue continued to grow and the company has also been increasing free cash flow. The stock has crushed the broader market this year and over the last five years.

UBER data by YCharts

Uber also has an opportunity to be a part of the autonomous vehicle wave. While the company will not build its own self-driving vehicles, it does plan to partner with companies in the autonomous space to help them reach commercialization and integrate autonomous vehicles into Uber’s fleet. In a presentation made in the fourth quarter of 2024, management presented the autonomous space as more than a $1 trillion opportunity.

The company said that the path to commercialization for companies developing self-driving vehicles faces several obstacles. These include navigating the regulatory landscape, ensuring safety, and having a scalable network and platform. Uber can help on all of these fronts and has already partnered with several large autonomous companies like Waymo and WeRide. Earlier this month, Uber and WeRide announce an expansion of their partnership to roll out autonomous vehicles in 15 cities across the world.

Trading at less than 25 times forward earnings, Uber has the opportunity to continue improving profitability and free cash flow, while also potentially tapping into the massive autonomous market over time, presenting a potential new stream of revenue.