CISA Scattered Spider Advisory November 2023

Scattered Spider can enumerate remote systems, such as VMware vCenter infrastructure.

Scattered Spider has also leveraged pre-existing AWS EC2 instances for lateral movement and data collection purposes.

Scattered Spider stages data in a centralized database prior to exfiltration.

Scattered Spider Spider enumerates a target organization for files and directories of interest, including source code, user provisioning, MFA device registration, network diagrams, and shared credentials in documents or spreadsheets.

Scattered Spider has enumerated legitimate domain accounts which are used in the targeted environment.

Scattered Spider has used proxy networks to hamper detection and has installed legitimate proxy tools on VMware vCenter and adversary-controlled VMs.

Scattered Spider searched the victim’s Microsoft Exchange for emails about the intrusion and incident response.

Scattered Spider creates new user identities within the compromised organization.

Scattered Spider has impersonated organization IT and helpdesk staff to instruct victims to execute commercial remote access tools to gain initial access.

Scattered Spider enumerates data stored within victim code repositories, such as internal GitHub repositories.

Scattered Spider threat actors search the victim’s Slack and Microsoft Teams for conversations about the intrusion and incident response.

Scattered Spider retrieves browser histories via infostealer malware such as Raccoon Stealer.

In addition to directing victims to run remote software, Scattered Spider members themselves also deploy RMM software including TeamViewer, AnyDesk, LogMeIn, ngrok, and ConnectWise to establish persistence on the compromised network.

Scattered Spider adds a federated identity provider to the victim’s SSO tenant and activates automatic account linking.

Scattered Spider has used BlackCat and DragonForce ransomware to encrypt files including on VMWare ESXi servers.

Scattered Spider enumerates data stored in cloud resources for collection and exfiltration purposes.

Scattered Spider abused AWS Systems Manager Inventory to identify targets on the compromised network prior to lateral movement.

Scattered Spider retrieves browser cookies via Raccoon Stealer.

Scattered Spider Spider searches for credential storage documentation on a compromised host.

Scattered Spider enumerate and exfiltrate code-signing certificates from a compromised host.

After compromising user accounts, Scattered Spider registers their own MFA tokens.

Scattered Spider has exfiltrated victim data to the MEGA file sharing site, SnowFlake, and AWS S3 buckets.

Scattered Spider has installed protocol-tunneling tools on VMware vCenter and adversary-controlled VMs, including Teleport.sh, Chisel (configured to communicate with trycloudflare[.]com subdomains), MobaXterm, ngrok, Pinggy, and Teleport.

Scattered Spider has created Amazon EC2 instances within the victim's environment.

Scattered Spider has created matching fake social media profiles to support new accounts created in victim environments.

Scattered Spider has obtained tools for use throughout the attack lifecycle to include remote access software, protocol tunneling and proxy tools, exploitation frameworks, and reconnaissance tools.

Scattered Spider has deployed ransomware on compromised hosts and threatened to leak stolen data for financial gain.

Scattered Spider utilized social engineering to compel IT help desk personnel to reset passwords and MFA tokens. Scattered Spider has also used Microsoft Teams to pose as internal IT support or help desk personnel.