Procedure examples

Scattered Spider has created Amazon EC2 instances within the victim's environment.

Scattered Spider enumerates cloud environments including Amazon Web Services (AWS) S3 buckets to identify server and backup management infrastructure, resource access, databases and storage containers .

Scattered Spider has registered domains to spoof legitimate corporate login portals.

Scattered Spider has created matching fake social media profiles to support new accounts created in victim environments.

Scattered Spider has obtained malware to use at multiple stages of operations including information stealers, remote access tools, and ransomware.

Scattered Spider has obtained tools for use throughout the attack lifecycle to include remote access software, protocol tunneling and proxy tools, exploitation frameworks, and reconnaissance tools.

Scattered Spider has used information from previous data breaches to identify employee names to be used in social engineering.

Scattered Spider has used a combination of credential phishing and social engineering to capture one-time-password (OTP) codes.

Scattered Spider has used domains mirroring corporate login portals to socially engineer victims into providing credentials.

Scattered Spider has used help desk voice-based phishing and also called employees at target organizations and compelled them to navigate to fake login portals using adversary-in-the-middle toolkits.

Scattered Spider has used multifactor authentication (MFA) fatigue by sending repeated MFA authentication requests to targets.

Scattered Spider has deployed ransomware on compromised hosts and threatened to leak stolen data for financial gain.

Scattered Spider utilized social engineering to compel IT help desk personnel to reset passwords and MFA tokens. Scattered Spider has also used Microsoft Teams to pose as internal IT support or help desk personnel.

Scattered Spider has uninstalled and disabled security tools.