How Scattered Spider Targets Identities—and How Organizations Can Defend Them
Summary
The article describes identity-focused tactics associated with Scattered Spider and recommends extending monitoring to cloud and third-party services, profiling logons, and correlating suspicious authentication activity.
Key points
- The article says social engineering of IT personnel appears to have enabled initial access in the MGM and Caesars incidents; attribution and details remained uncertain.
- Scattered Spider-associated tactics include impersonating IT staff, credential-harvesting phishing, and MFA fatigue to gain access to user accounts.
- The article notes that attackers may use legitimate remote-management tools and other methods for follow-on activity and lateral movement.
- Organizations should identify and monitor logs from external identity providers, cloud applications, and other services attackers may target, correlating them with internal network observations where possible.
- Recommended controls include profiling typical logon locations, monitoring for account takeover indicators, and correlating repeated MFA prompts with other suspicious activity.
- Organizations can respond to suspected identity compromise by disabling accounts or isolating affected assets; the article cautions against placing the burden solely on user awareness.
Article Details
- Defense Focus
- Extend monitoring beyond the traditional network perimeter to detect and respond to identity-focused attacks and account abuse.
- Detection Methods
- Profile user logons by geographic and logical location and identify deviations from typical activity.
- Monitor for actions correlated with account takeover or abuse.
- Correlate MFA fatigue activity with other observable events.
- Correlate third-party and cloud-application activity with observations from the traditional network environment.
- Data Sources
- Third-party service and cloud-application logs
- Identity-provider and authentication logs
- Network-environment observations
- Defensive Actions
- Identify critical external identity providers, authentication mechanisms, and related services; harden them and monitor for abuse.
- Incorporate external application logs into existing security monitoring or use a third party for monitoring and alerting.
- Apply zero-trust approaches while extending monitoring to external identity environments where possible.
- Provide security awareness and management in response to suspicious identity activity.
- Disable accounts or isolate assets touched by a potentially compromised identity.
MITRE ATT&CK
T1078 · Valid AccountsAfter acquiring credentials, the threat actor attempts to impersonate legitimate users.T1219 · Remote Access ToolsThe article says Scattered Spider may install legitimate remote monitoring and management software for malicious follow-on access.T1566 · PhishingScattered Spider operations are described as using phishing techniques and credential-harvesting portals spoofing popular services.T1621 · Multi-Factor Authentication Request GenerationThe article describes MFA fatigue: using obtained credentials to send repeated push notifications in an attempt to make a victim accept a request.T1656 · ImpersonationScattered Spider is described as impersonating IT staff through SMS, Telegram, or voice calls to socially engineer employees.
Threat Actors
ALPHVAlso referred to in the article as BlackCat; previous reporting linked ALPHV with Scattered Spider activity, but their precise relationship is stated to be unclear.BlackCatThe article identifies BlackCat as another name for ALPHV; previous reporting linked it with Scattered Spider activity, while their precise relationship is stated to be unclear.Scattered SpiderCriminal threat actor linked in reporting to the MGM incident and potentially the Caesars intrusion; the article describes its identity-focused social engineering and account-abuse activity.