Scattered Spider

Scattered Spider is a notorious threat actor group known for its malicious cyber activities. The group primarily targets enterprise data within Software as a Service (SaaS) applications, including less sophisticated outfits and more well-known systems such as Microsoft cloud environments and on-premises infrastructure. Scattered Spider has been observed using various tactics to infiltrate target networks, including phishing to obtain login credentials, searching SharePoint repositories for information, maintaining persistence on the network, and exfiltrating data for extortion purposes. They have also demonstrated proficiency in exploiting remote systems and infrastructure. In recent years, Scattered Spider has been involved in several high-profile attacks. In one instance, they managed to gain global administrator rights to MGM Resorts' Azure instances, leading to significant data exfiltration and operational disruption. They have also been linked to a series of rapid, high-profile social engineering attacks aimed at bypassing multi-factor authentication. Furthermore, the group was tied to an attack on Bozeman, Montana-based Snowflake, where around 165 customers were notified of potential breaches by the threat group codenamed UNC5537, also known as Scattered Spider. As of May 2024, Scattered Spider continues to pose a significant threat to organizations worldwide. Their tactics have been observed in unclaimed attacks, such as the one on MoneyGram, demonstrating their ongoing activity. The group was seen establishing a foothold on a cloud-hosted virtual machine via a cloud service VM management agent. Scattered Spider, along with another threat actor group COZY BEAR, have shown cross-domain proficiency, enabling them to navigate multiple operating systems and security platforms swiftly and confidently. Both groups are capable of infiltrating all major cloud service providers, with Scattered Spider being financially motivated and COZY BEAR often targeting Azure services for data theft.