TRJ CYBERSECURITY INTEL REPORT
Category: Financial Services Cyberattack
Features: Social engineering, call center compromise, lateral movement, system disruption
Delivery Method: Phone-based impersonation (vishing), credential harvesting, insider pivoting
Threat Actor: Scattered Spider / UNC3944 (affiliated with The Com)
Discovery Date
June 2025 — Google’s Threat Intelligence Group (TIG) issues a formal warning to U.S.-based insurance companies, confirming multiple breaches matching the tradecraft of Scattered Spider — a notorious cybercriminal syndicate known for coordinated social engineering campaigns.
THEY’RE INSIDE THE NETWORK NOW: How Scattered Spider Is Using Your Own Voice Against You
It didn’t begin with malware. It began with mimicry — the sound of someone who shouldn’t have access… asking for it, and getting it.
This time, the intruder didn’t come through a firewall. It called the help desk, played the part of a panicked employee, and convinced someone to reset a password.
The breach didn’t explode. It unfolded. Quietly. Deliberately.
Scattered Spider, the English-speaking hacker collective behind some of the most disruptive recent attacks in the U.S. and U.K., has shifted its focus from flashy hits on retail giants to a quieter goldmine: the insurance industry. And what they’re after isn’t just financial — it’s systemic.
They want every record, every claim, every voiceprint, and every map of your digital life sitting inside an insurance company’s CRM. And they’re doing it with one of the oldest tactics in espionage: social engineering. They’re not hacking systems — they’re hacking people.
Multiple U.S. insurance companies, including Erie Insurance and Philadelphia Insurance Companies, have confirmed cyber incidents in the past week. Their websites went down. Phone systems failed. Emails bounced. Internally, teams were forced into “proactive containment.” Externally, the public was told almost nothing. No ransomware. No data leak (yet). Just silence — and an ominous admission: they still don’t know exactly how deep the breach goes.
What’s clear is that Scattered Spider — operating under the threat actor designation UNC3944 — has evolved. No longer content with casino jackpots or retail credentials, they’re going after the backbone of American identity. Insurance records contain everything: SSNs, medical conditions, behavioral reports, and financial stress indicators. To a threat actor, this isn’t data. It’s leverage.
And they’re getting it by tricking help desk agents into handing over keys. Resetting logins. Escalating privileges. Unlocking Salesforce panels. From there, it’s just a matter of pivoting laterally — until the entire organization is compromised from the inside out.
This is what warfare looks like now. Not explosions. Not alarms. But a call, a voice, and access that feels earned — until it’s too late to revoke it. They don’t need to break in.
They just need someone to believe they belong.
THE SECTOR SHIFT — RETAIL WAS JUST THE WARMUP
They built their name breaking into retail chains, dressing up as help desk support and sweet-talking their way through enterprise gates. But that was only Phase One. Now, Scattered Spider — the cybercrew linked to UNC3944 and the broader Com criminal ecosystem — has pivoted to a new target: insurance.
This time, it’s not about grabbing logins for store terminals. It’s about full system access to some of the most data-rich corporate vaults in America.
Insurance companies handle the crown jewels of digital identity:
- Personal information
- Financial account histories
- Policy details
- Medical records
- Government ID numbers
- Behavioral risk models
And Scattered Spider knows exactly how to reach it — one compromised phone call at a time.
CONFIRMED ATTACKS: NETWORKS DOWN, RESPONSES QUIET
At least two major U.S. insurance providers have confirmed ongoing cybersecurity incidents:
- Erie Insurance filed a report with the SEC disclosing system outages caused by “proactive containment measures.” No official group was named, but timing and method align with Spider’s recent campaigns. Erie claims no ransomware was deployed — a known Spider pattern of restraint during access harvesting.
- Philadelphia Insurance Companies suffered a broader breach on June 9, resulting in full phone and email outages. Their public website now features a law enforcement notice, indicating external assistance and probable federal investigation.
Meanwhile, in Europe, a major Swedish insurer’s website was taken offline, believed to be part of a parallel campaign exploiting the same human-first breach tactics.
TACTICS: VOICES THAT BREACH
What sets Scattered Spider apart is their patience — and their accent.
Unlike traditional ransomware crews, they don’t kick down the firewall. They get invited in.
- Vishing attacks: Voice phishing over the phone, targeting internal IT support.
- Impersonation: Fluent English-speakers pose as employees needing password resets.
- Help desk scripts: Custom playbooks to escalate privileges by exploiting call center protocol gaps.
- Salesforce Exploits: A recent breach campaign involved tricking companies into granting backend access to Salesforce portals, then using that access to spider across internal environments.
UNC3944 — THE ACTOR BEHIND THE MASK
Google refers to this threat cluster as UNC3944, a sub-faction of Scattered Spider with a more narrow operational scope but identical playbook. The distinction isn’t cosmetic — it’s tactical. UNC3944 prefers sectors with high phone-based authentication layers and distributed IT functions.
And the insurance industry checks every box:
- Call centers with shifting staff
- Distributed office infrastructure
- Legacy software
- High-value client data
- Regulatory pressure to stay silent during incidents
KNOWN ATTACKS: A TRAIL OF SOCIAL ENGINEERING WRECKAGE
- MGM Resorts & Caesars Entertainment (2023) — Breached via help desk manipulation
- Victoria’s Secret, Harrods, Dior, Adidas, North Face, Cartier (2024–2025) — Multi-region retail data breaches
- Marks & Spencer, Co-op U.K. — Phone-based impersonation led to system access
- Salesforce Access Theft — Unlocked sensitive customer data across victim organizations
EXPERT FORECAST
John Hultquist, Chief Analyst at Google TIG:
“Scattered Spider actors specialize in targeting human infrastructure. If your defenses rely on trust-based phone interactions, they will find a way in.”
Fletcher Davis, BeyondTrust:
“The size and complexity of insurance firms make them fertile ground for obfuscation, internal delay, and data harvesting before detection. These actors thrive in silos and bureaucracy.”
TRJ VENDOR WATCHLIST
All insurance vendors and partners should immediately:
- Audit help desk escalation procedures
- Restrict password resets without secondary verification
- Conduct phishing simulations and vishing scenario testing
- Review Salesforce and CRM access logs
- Monitor for behavioral anomalies in staff login behavior
TRJ VERDICT
Scattered Spider isn’t gone. It evolved.
And now, it’s speaking your language, dialing your number, and dressing up in your IT department’s skin. The insurance sector is the next front line not because it’s weak — but because its attack surface includes people.
This isn’t brute-force hacking. This is deception warfare.
And the breach doesn’t begin when the system goes down — it begins when the help desk picks up.
🔥 NOW AVAILABLE! 🔥
📖 INK & FIRE: BOOK 1 📖
A bold and unapologetic collection of poetry that ignites the soul. Ink & Fire dives deep into raw emotions, truth, and the human experience—unfiltered and untamed.
🔥 Kindle Edition 👉 https://a.co/d/9EoGKzh
🔥 Paperback 👉 https://a.co/d/9EoGKzh
🔥 Hardcover Edition 👉 https://a.co/d/0ITmDIB
Get your copy today and experience poetry like never before. #InkAndFire #PoetryUnleashed #FuelTheFire
🚨 NOW AVAILABLE! 🚨
📖 THE INEVITABLE: THE DAWN OF A NEW ERA 📖
A powerful, eye-opening read that challenges the status quo and explores the future unfolding before us. Dive into a journey of truth, change, and the forces shaping our world.
🔥 Kindle Edition 👉 https://a.co/d/0FzX6MH
🔥 Paperback 👉 https://a.co/d/2IsxLof
🔥 Hardcover Edition 👉 https://a.co/d/bz01raP
Get your copy today and be part of the new era. #TheInevitable #TruthUnveiled #NewEra
🚀 NOW AVAILABLE! 🚀
📖 THE FORGOTTEN OUTPOST 📖
The Cold War Moon Base They Swore Never Existed
What if the moon landing was just the cover story?
Dive into the boldest investigation The Realist Juggernaut has ever published—featuring declassified files, ghost missions, whistleblower testimony, and black-budget secrets buried in lunar dust.
🔥 Kindle Edition 👉 https://a.co/d/2Mu03Iu
🛸 Paperback Coming Soon
Discover the base they never wanted you to find. TheForgottenOutpost #RealistJuggernaut #MoonBaseTruth #ColdWarSecrets #Declassified
Support truth, health, and preparedness by shopping the Alex Jones Store through our link. Every purchase helps sustain independent voices and earns us a 10% share to fuel our mission. Shop now and make a difference!
https://thealexjonesstore.com?sca_ref=7730615.EU54Mw6oyLATer7a
Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com
