Mitigating advanced social engineering threats: multi-factor authentication and the evolving tactics of Scattered Spider in the aviation sector
DOI:
https://doi.org/10.34140/bjbv7n3-003Palavras-chave:
aviation security, multi-factor authentication, cybercriminal groups, social engineering, threat mitigation, identity verification, regulatory compliance, cybersecurity policy, IT help desk, ransomwareResumo
The rapid escalation of cyber threats targeting critical infrastructure, notably the aviation industry, has intensified the need for resilient cybersecurity frameworks. This study examines the evolving tactics of the cybercriminal group Scattered Spider, which has recently expanded its operations to include airlines and their service providers, exploiting procedural weaknesses in multi-factor authentication (MFA) systems. Through a comprehensive scoping literature review of peer-reviewed articles, industry reports, and case studies published between 2019 and 2025, and by analyzing recent real-world incidents such as those at WestJet and Hawaiian Airlines, this research identifies persistent vulnerabilities in MFA implementation and the limitations of current security measures against advanced social engineering attacks. The study’s findings confirm that while MFA remains a robust technical safeguard, its effectiveness is significantly undermined by human factors and gaps in organizational processes, particularly at IT help desks. The research contributes novel insights by integrating socio-technical analysis with sector-specific threat assessment, offering actionable recommendations for aviation stakeholders and regulatory bodies. These results are of high practical value for cybersecurity practitioners, policymakers, and organizational leaders seeking to enhance authentication practices and protect critical operations from emerging cyber threats. The outcomes are expected to inform policy development, security training, and technology adoption across industries facing similar risks.
Referências
Amft, S., Höltervennhoff, S., Huaman, N., Krause, A., Simko, L., Acar, Y., & Fahl, S. (2023). We've disabled MFA for you: An evaluation of the security and usability of multi-factor authentication recovery deployments. Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, 3138–3152. DOI:10.1145/3576915.3623180
Anderson, J., & Rainie, L. (2023). As AI spreads, experts predict the best and worst changes. Pew Research Center. https://www.pewresearch.org/internet/2023/06/21/themes-the-most-harmful-or-menacing-changes-in-digital-life-that-are-likely-by-2035/
Akinsanya, M. O., Ekechi, C. C., & Okeke, C. D. (2024). Data sovereignty and security in network engineering: A conceptual framework for compliance. International Journal of Science and Research Archive, 11(2), 1832–1847. DOI:10.30574/ijsra.2024.11.2.0682
Awad, A. I., Babu, A., Barka, E. S., & Shuaib, K. (2024). AI-powered biometrics for Internet of Things security: A review and future vision. Journal of Information Security and Applications. DOI:10.1016/j.jisa.2024.103748
Bakhuis, J., Kamp, L. M., Barbour, N., & Chappin, É. J. L. (2024). Frameworks for multi-system innovation analysis from a sociotechnical perspective: A systematic literature review. Technological Forecasting and Social Change, 201, Article 123266. https://doi.org/10.1016/j.techfore.2024.123266
Bartiromo, M. (2025, June 30). Cybercrime group is targeting airlines, FBI says: How are passengers being affected? The Hill. https://thehill.com/homenews/nexstar_media_wire/5377102-cybercrime-group-is-targeting-airlines-fbi-says-how-are-passengers-being-affected/
BeyondTrust. (2024, June 21). The state of identity security for 2024: Identity-based threats, breaches, and security best practices. BeyondTrust. https://www.beyondtrust.com/blog/entry/the-state-of-identity-security-identity-based-threats-breaches-security-best-practices
Burrell, D. N. (2021). Cybersecurity leadership from a talent management organizational development lens. [Unpublished Exegesis]. Capitol Technology University.
Burton, S. L. (2025). Advancing Cybersecurity: Strategic Insights Into Multifactor Authentication. In Organizational Readiness and Research: Security, Management, and Decision Making. IGI Global. https://doi.org/10.4018/979-8-3693-8562-3.ch008
Burton, S. L. (2023). Cybersecurity risk: The business significance of ongoing tracking. In D. N. Burrell (Ed.), Transformational Interventions for Business, Technology, and Healthcare (pp. 245–268). IGI Global. https://doi.org/10.4018/979-8-3693-1634-4.ch015
Cybersecurity Infrastructure Security Agency [CISA]. (2022). Implementing Phishing-Resistant MFA. Cybersecurity and Infrastructure Security Agency. Author. https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf
Carmakal, C., (2024). Cybersecurity: A five-year review of threats and trends, Federal Reserve Bank of New York. United States of America. Policy Commons. https://coilink.org/20.500.12592/3q9qrhw on 30 Jun 2025. COI: 20.500.12592/3q9qrhw.
Christine, D. I., & Thinyane, M. (2022). Socio-technical cyber resilience: A systematic review of cyber resilience management frameworks. In Digital Transformation for Sustainability (pp. 573–597). Springer. https://doi.org/10.1007/978-3-031-15420-1_28
Chung, Y. Y., Annaswamy, T. M., & Prabhakaran, B. (2023). Performance and user experience studies of HILLES: Home-based immersive lower limb exergame system. Proceedings of the 14th Conference on ACM Multimedia Systems, 62–73. DOI:10.1145/3587819.3590985
Dommari, S., & Jain, A. (2025). The impact of IoT security on critical infrastructure protection: current challenges and future directions. SSRN 5259329. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5259329
Fält, M. (2020). Multi-factor authentication: System proposal and analysis of continuous authentication methods. Umeå University. https://www.diva-portal.org/smash/get/diva2:1442569/FULLTEXT01.pdf
Gilbert, C., & Gilbert, M. A. (2025). Continuous user authentication on mobile devices. International Research Journal of Advanced Engineering and Science, 10(1), 158-173. https://irjaes.com/wp-content/uploads/2025/03/IRJAES-V10N1P355Y25.pdf
Grassi, P., Garcia, M., & Fenton, J. (2017). NIST Special Publication 800-63-3: Digital Identity Guidelines. National Institute of Standards and Technology. https://csrc.nist.gov/pubs/sp/800/63/3/upd1/final
Jones, L. A. (2020). Reputation risk and potential profitability: best practices to predict and mitigate risk through amalgamated Factors (Order No. 28152966). Available from ProQuest One Academic; Publicly Available Content Database. (2466047018). https://www.proquest.com/dissertations-theses/reputation-risk-potential-profitability-best/docview/2466047018/se-2
JPMorgan Chase & Co. (2021, December 16). Chase’s 2021 digital banking attitudes study finds consumers continue to adopt digital banking tools to manage their finances. JPMorgan Chase Newsroom. https://media.chase.com/news/chases-2021-digital-banking-attitudes-study
Karuppiah, S. P. (2025). Understanding the behaviour of business users in multi-factor authentication adoption (Master’s thesis). Lappeenranta–Lahti University of Technology LUT. https://lutpub.lut.fi/bitstream/handle/10024/169612/Masterthesis_Karuppiah_SivamPrasath.pdf?sequence=1
Khan, M. J. (2023). Zero trust architecture: Redefining network security paradigms in the digital age. World Journal of Advanced Research and Reviews, 19(3), 105–116. DOI:10.9734/JERR/2024/v26i21083
Khadka, K., & Ullah, A.B. (2025). Human factors in cybersecurity: an interdisciplinary review and framework proposal. International Journal of Information Security, 24,(119). https://doi.org/10.1007/s10207-025-01032-0
Kwon, H., & Johnson, M. E. (2022). Cybersecurity resilience in aviation: A socio-technical systems approach. Journal of Air Transport Management, 104, 102278. https://doi.org/10.1016/j.jairtraman.2022.102278
Lakshmanan, R. (2025, June 28). FBI warns of Scattered Spider's expanding attacks on airlines using social engineering. The Hacker’s News. https://thehackernews.com/2025/06/fbi-warns-of-scattered-spiders.html
Lewis, C., Kristensen, I., Caso, J., & Fuchs, J. (2025, May 15). AI is the greatest threat—and defense—in cybersecurity today. Here’s why. McKinsey & Company. https://www.mckinsey.com/about-us/new-at-mckinsey-blog/ai-is-the-greatest-threat-and-defense-in-cybersecurity-today
Mahmood, S., Chadhar, M., & Firmin, S. (2024). Addressing cybersecurity challenges in times of crisis: Extending the sociotechnical systems perspective. Applied Sciences, 14(24), 11610. https://doi.org/10.3390/app142411610
Mak, S., & Thomas, A. (2022). Steps for conducting a scoping review. Journal of Graduate Medical Education, 14(5), 565–567. https://doi.org/10.4300/JGME-D-22-00621.1
Malatji, M., Von Solms, S., & Marnewick, A. (2019). Socio-technical systems cybersecurity framework. Information and Computer Security, 27(2), 246–264. https://doi.org/10.1108/ICS-03-2018-0031
Marino, P. H. M., Costa, A. L. F., & Dutra, J. A. A. (2025). Analysis of ANBIMA certifications: motivations, benefits and perspectives for professionals and financial institutions. Brazilian Journal of Business, 7(1), e76662-e76662. DOI: https://doi.org/10.34140/bjbv7n1-001
McFarlane, P. (2020). Linking aviation security failures to human-mediated error: A review of the related literatures with directions for policy and research. Journal of Transportation Security, 13, 33–51. https://doi.org/10.1007/s12198-020-00209-z
Meyer, L. A., Romero, S., Bertoli, G., Burt, T., Weinert, A., & Lavista Ferres, J. (2023). How effective is multifactor authentication at deterring cyberattacks? arXiv preprint arXiv:2305.00945. https://doi.org/10.48550/arXiv.2305.00945
Microsoft Build. (2024). Security at your organization – Multifactor authentication (MFA) statistics. Microsoft. https://learn.microsoft.com/en-us/partner-center/security/security-at-your-organization
Murugalakshmi, S., & Robin, C. R. (2023). Advancements in mobile security: A comprehensive study of sim card swapping and cloning—trends, challenges and innovative solutions. I-Manager’s Journal on Mobile Applications & Technologies, 10(1). DOI:10.26634/jmt.10.1.20103
Nobles, C. (2023). A socio-technical approach to cybersecurity: Addressing the human factor in advanced persistent threats. Journal of Cybersecurity and Privacy, 3(2), 145–162. https://doi.org/10.3390/jcp3020010
Nobles, C. (2021). Cybersecurity: The human factor. In Cybersecurity and Resilience in the Digital Age (pp. 45–62). Springer. https://doi.org/10.1007/978-3-030-71103-9_3
Office of Management and Budget (OMB). (2022). OMB Memorandum M-22-09: Moving the U.S. government toward zero trust cybersecurity principles. Author. https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf
Oloid. (2025, May 12). Liveness detection guide: Protecting digital identity 2025. Oloid. https://www.oloid.com/blog/liveness-detection
Otto, G. (2025, June 27). Scattered Spider strikes again? Aviation industry appears to be next target for criminal group. Cyberscoop. https://cyberscoop.com/scattered-spider-aviation-hawaiian-airlines-cyberattack/
Özşahan, H. (2023, November 23). 40+ Multi-factor authentication (MFA) statistics to know in 2024. Resmo Inc. https://www.resmo.com/blog/multifactor-authentication-statistics
Pollini, A., Callari, T. C., Tedeschi, A., Ruscio, D., Save, L., Chiarugi, F., & Guerri, D. (2022). Leveraging human factors in cybersecurity: An integrated methodological approach. Cognition, Technology & Work, 24, 371–390. https://doi.org/10.1007/s10111-021-00683-y
Palo Alto Networks. (2025). Unit 42 threat intelligence update: Scattered Spider targeting aviation sector [Press release]. Palo Alto Networks. https://www.paloaltonetworks.com/unit42
Polojärvi, D., Palmer, E., & Dunford, C. (2023). A systematic literature review of sociotechnical systems in systems engineering. Systems Engineering, 26(3), 1–23. https://doi.org/10.1002/sys.21664
Riggs, H., Tufail, S., Parvez, I., Tariq, M., Khan, M. A., Amir, A., Vuda, K. V., & Sarwat, A. I. (2023). Impact, vulnerabilities, and mitigation strategies for cyber-secure critical infrastructure. Sensors, 23(8), 4060. https://doi.org/10.3390/s23084060
Rosencrance, L., (2024, October 3). Why zero trust needs MFA to succeed: Expert analysis. Techopedia. https://www.techopedia.com/why-zero-trust-needs-mfa-to-succeed
Stęchły, A., & Szpunar, A. (2023). Analysis of potential risks of SMS-based authentication. Advances in Web Development Journal, 1(1). https://doi.org/10.5281/zenodo.10049987
Swain, G. (2025, June 30). Scattered Spider shifts focus to airlines with strikes on Hawaiian and WestJet. Computer Security Online. https://www.csoonline.com/article/4014787/scattered-spider-shifts-focus-to-airlines-after-strikes-on-hawaiian-and-westjet.html
Tambunan, P. N. P., Legowo, N., & Tambunan, D. R. (2024). Strengthening payment card data security: A study on compliance enhancement and risk mitigation through MFA implementation under PCI DSS 4.0. Journal of Theoretical and Applied Information Technology, 102(9).
Trist, E. L., & Bamforth, K. W. (1951). Some social and psychological consequences of the longwall method of coal-getting. Human Relations, 4(1), 3–38. https://doi.org/10.1177/001872675100400101
Wahab, A., Khan, M. A., & Khan, S. (2023). Exploring the cost implications of multi-factor authentication in enterprise environments. Journal of Cybersecurity Research, 8(2), 134–149.
Windham, A. (2025, June 11). AI-generated deepfakes in court: An emerging threat to evidence authenticity?. https://natlawreview.com/article/ai-generated-deepfakes-court-emerging-threat-evidence-authenticity
Zhang, J., & Tenney, D. (2024). The evolution of integrated advanced persistent threat and its defense solutions: A literature review. Open Journal of Business and Management, 12(1), 293–338. https://doi.org/10.4236/ojbm.2024.121021
