Detect SSH login after social engineering

Summary

MGM Resorts recently fell victim to a cyberattack orchestrated by a group called Scattered Spider, who employed vishing (voice phishing) techniques to gain access to the company’s systems. The attackers, believed to be in their late teens and early 20s and fluent in English, impersonated an employee in a call to MGM’s IT help desk to obtain login credentials. While Scattered Spider initially planned to hack MGM’s slot machines, they later stole and encrypted the company’s data, demanding a ransom in cryptocurrency. The attack sheds light on the effectiveness of vishing, a form of social engineering, and highlights the need for better cybersecurity training and measures to protect against such threats.