Hawaiian Airlines, WestJet and Qantas each reported cyberattacks during June 2025. Authorities attributed the activity to the social-engineering tactics of the cluster tracked as Scattered Spider. The Qantas incident, detected 30 June, is filed at 25-0701.
This Is The Rotation, Observed In Real Time
Insurance in June at 25-0622. Aviation in the same month. Retail earlier in the year at 25-0430 and 25-0501.
The corpus filed the mechanism at 25-0512: research is reusable within a sector because the vendors, outsourcers, support scripts and system vocabulary repeat. Three carriers in three weeks is that argument at its tightest.
It also means the warning window is measured in days rather than months. An airline reading about Hawaiian on a Monday had, at most, a fortnight.
Aviation Shares Insurance’s Weak Point
A carrier’s support estate serves crew, ground handlers, contracted staff at outstations, travel agents and codeshare partners — a large, distributed population the service desk cannot identify by sight.
That is the same structural surface as the intermediary population at 25-0601, and it is why the campaign moved between the two sectors without changing technique.
And The FBI Warned Publicly, Which Is Unusual
Contemporary reporting records US federal warnings about the group targeting airlines during the campaign. That is close to the cross-incident warning mechanism this desk proposed at 25-0830 — an authority observing a pattern and telling the rest of the sector.
It arrived after three carriers, which is faster than the insurance sequence and still after the fact. The corpus records it as the mechanism working partially rather than not at all.
Compiled from public reporting, listed below. Attribution follows official and research assessments as reported. Corrections: corrections@forensicpost.com.