Procedure examples

Scattered Spider has extracted the `NTDS.dit` file by creating volume shadow copies of virtual domain controller disks.

Scattered Spider has created volume shadow copies of virtual domain controller disks to extract the `NTDS.dit` file.

Scattered Spider has used network reconnaissance commands for discovery including `ping` and `nltest`.

Scattered Spider can enumerate remote systems, such as VMware vCenter infrastructure.

Scattered Spider has used RDP to enable lateral movement.

Scattered Spider has used SSH to move laterally in victim environments and to access the vSphere vCenter Server GUI.

Scattered Spider has also leveraged pre-existing AWS EC2 instances for lateral movement and data collection purposes.

Scattered Spider has exfiltrated data from compromised VMware vCenter servers through an established C2 channel using the Teleport remote access tool.

Scattered Spider has used the PowerShell cmdlet Get-ADUser.

Scattered Spider has used the command shell to upload and install the Teleport remote access tool to a compromised vCenter Server Appliance.

Scattered Spider has deployed a malicious kernel driver through exploitation of CVE-2015-2291 in the Intel Ethernet diagnostics driver for Windows (iqvw64.sys).

Scattered Spider has enumerated the vSphere Admins and ESX Admins groups in targeted environments.

Scattered Spider has enumerated Active Directory security groups including through the use of ADExplorer, ADRecon.ps1, and Get-ADUser.

Scattered Spider has manually deleted emails notifying users of suspicious account activity.

Scattered Spider stages data in a centralized database prior to exfiltration.

Scattered Spider has used compromised credentials for initial access.

Scattered Spider has used compromised Microsoft Entra ID accounts to pivot in victim environments.

Scattered Spider has executed scripts to identify the underlying operating system to ensure it uses the correct installation package for malicious payloads.

Scattered Spider Spider enumerates a target organization for files and directories of interest, including source code, user provisioning, MFA device registration, network diagrams, and shared credentials in documents or spreadsheets.

Scattered Spider has identified vSphere administrator accounts.

Scattered Spider has enumerated legitimate domain accounts which are used in the targeted environment.

Scattered Spider has used proxy networks to hamper detection and has installed legitimate proxy tools on VMware vCenter and adversary-controlled VMs.

Scattered Spider has added accounts to the ESX Admins group to grant them full admin rights in vSphere.

Scattered Spider has assigned user access admin roles in order to gain Tenant Root Group management permissions in Azure.

Scattered Spider has downloaded the Teleport remote access tool to compromised VMware vCenter Servers.

Scattered Spider searched the victim’s Microsoft Exchange for emails about the intrusion and incident response.

Scattered Spider has redirected emails notifying users of suspicious account activity.

Scattered Spider has leveraged legitimate remote management tools to maintain persistent access.

Scattered Spider creates new user identities within the compromised organization.

Scattered Spider has impersonated organization IT and helpdesk staff to instruct victims to execute commercial remote access tools to gain initial access.

Scattered Spider enumerates data stored within victim code repositories, such as internal GitHub repositories.

Scattered Spider threat actors search the victim’s Slack and Microsoft Teams for conversations about the intrusion and incident response.

Scattered Spider retrieves browser histories via infostealer malware such as Raccoon Stealer.

In addition to directing victims to run remote software, Scattered Spider members themselves also deploy RMM software including TeamViewer, AnyDesk, LogMeIn, ngrok, and ConnectWise to establish persistence on the compromised network.

Scattered Spider adds a federated identity provider to the victim’s SSO tenant and activates automatic account linking.

Scattered Spider has used BlackCat and DragonForce ransomware to encrypt files including on VMWare ESXi servers.

Scattered Spider has stopped the Volume Shadow Copy service on compromised hosts.

Scattered Spider enumerates data stored in cloud resources for collection and exfiltration purposes.

Scattered Spider abused AWS Systems Manager Inventory to identify targets on the compromised network prior to lateral movement.

Scattered Spider retrieves browser cookies via Raccoon Stealer.

Scattered Spider has run `SYSTEMD_UNIT_PATH="/lib/systemd/
system/teleport.service` to establish persistence for the Teleport remote access tool.

Scattered Spider Spider searches for credential storage documentation on a compromised host.

Scattered Spider enumerate and exfiltrate code-signing certificates from a compromised host.

Scattered Spider has used self-signed and stolen certificates originally issued to NVIDIA and Global Software LLC.

Scattered Spider has searched for credentials in password vaults and Privileged Access Management (PAM) solutions including HashiCorp Vault.

After compromising user accounts, Scattered Spider registers their own MFA tokens.

Scattered Spider has added additional trusted locations to Azure AD conditional access policies.

Scattered Spider creates inbound rules on the compromised email accounts of security personnel to automatically delete emails from vendor security products.

Scattered Spider has exfiltrated victim data to the MEGA file sharing site, SnowFlake, and AWS S3 buckets.

Scattered Spider has installed protocol-tunneling tools on VMware vCenter and adversary-controlled VMs, including Teleport.sh, Chisel (configured to communicate with trycloudflare[.]com subdomains), MobaXterm, ngrok, Pinggy, and Teleport.