If you think your business has been impacted, we urge you to reach out to your Marsh contact or one of our cyber specialists as soon as possible.
Here are the ways we can help if you have been or suspect you have been impacted.
Event management
- Engaging technical assistance for your organization, to help investigate any suspected compromise and to work on containment.
- Supporting crisis management and communications.
Insurance coverage/recovery
- Submitting a notice of circumstance or claim against your cyber insurance and supporting the recovery of maximum reimbursement under your policy.
We will continue to monitor the situation and will keep you apprised of further developments.
Further guidance
- Emphasizing preparedness: The role of out-of-band communications in cyber incident response. Read more.
- May 21 webcast: Proactive defense against UNC3944: Hardening your enterprise. Register here.
- CISA Advisory on Scattered Spider tactics, techniques, and procedures (TTPs) and defense recommendations. Read more.
- SANS blog on defending against Scattered Spider. Read more.
- Group-IB blog on Dragonforce ransomware (the ransomware gang Scatter Spider partnered with) TTPs and defense recommendations. Read more.
- Dragonforce Ransomware reverse engineering. Read more
- Scattered Spider: The Modus Operandi. Read more.
- CYGNVS Overview. Read more.