A sophisticated and highly targeted cyber-attack campaign has been identified by security researchers in Google’s Threat Intelligence Group (GTIG). A new report has revealed how the financially motivated threat group UNC3944, also known as Scattered Spider, has pivoted its operations to exploit VMware vSphere environments across the US retail, airline and insurance sectors. Scattered Spider actors have also adopted an aggressive, low-exploit playbook focused on social engineering and infrastructure abuse. Their strategy begins with phone-based impersonation to breach IT help desks, ultimately enabling access to Active Directory. From there, attackers methodically map administrative systems, escalate privileges and move laterally into the virtual infrastructure, without triggering…