Mandiant UNC3944 May 2025

Scattered Spider has used network reconnaissance commands for discovery including `ping` and `nltest`.

Scattered Spider has used RDP to enable lateral movement.

Scattered Spider has used SSH to move laterally in victim environments and to access the vSphere vCenter Server GUI.

Scattered Spider has used compromised credentials for initial access.

Scattered Spider Spider enumerates a target organization for files and directories of interest, including source code, user provisioning, MFA device registration, network diagrams, and shared credentials in documents or spreadsheets.

In addition to directing victims to run remote software, Scattered Spider members themselves also deploy RMM software including TeamViewer, AnyDesk, LogMeIn, ngrok, and ConnectWise to establish persistence on the compromised network.

Scattered Spider has stopped the Volume Shadow Copy service on compromised hosts.

Scattered Spider Spider searches for credential storage documentation on a compromised host.

Scattered Spider has searched for credentials in password vaults and Privileged Access Management (PAM) solutions including HashiCorp Vault.

Scattered Spider enumerates cloud environments including Amazon Web Services (AWS) S3 buckets to identify server and backup management infrastructure, resource access, databases and storage containers .

Scattered Spider has obtained malware to use at multiple stages of operations including information stealers, remote access tools, and ransomware.

Scattered Spider has obtained tools for use throughout the attack lifecycle to include remote access software, protocol tunneling and proxy tools, exploitation frameworks, and reconnaissance tools.

Scattered Spider utilized social engineering to compel IT help desk personnel to reset passwords and MFA tokens. Scattered Spider has also used Microsoft Teams to pose as internal IT support or help desk personnel.

Scattered Spider has uninstalled and disabled security tools.