Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Поиск
Вход Регистрация
MITRE ATT&CK - Преступная группа Scattered Spider
Риски
Каталоги
MITRE ATT&CK
Преступная группа
Scattered Spider
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

Scattered Spider

Scattered Spider is a native English-speaking cybercriminal group that has been active since at least 2022.(Citation: CrowdStrike Scattered Spider Profile)(Citation: MSTIC Octo Tempest Operations October 2023) The group initially targeted customer relationship management and business-process outsourcing (BPO) firms as well as telecommunications and technology companies. Beginning in 2023, Scattered Spider expanded its operations to compromise victims in the gaming, hospitality, retail, MSP, manufacturing, and financial sectors.(Citation: MSTIC Octo Tempest Operations October 2023) During campaigns, Scattered Spider has leveraged targeted social-engineering techniques, attempted to bypass popular endpoint security tools, and more recently, deployed ransomware for financial gain.(Citation: CISA Scattered Spider Advisory November 2023)(Citation: CrowdStrike Scattered Spider BYOVD January 2023)(Citation: CrowdStrike Scattered Spider Profile)(Citation: MSTIC Octo Tempest Operations October 2023)(Citation: Crowdstrike TELCO BPO Campaign December 2022)
ID: G1015
Associated Groups: Octo Tempest, Roasted 0ktapus, Storm-0875
Version: 2.0
Created: 05 Jul 2023
Last Modified: 04 Apr 2024

Associated Group Descriptions
Name Description
Octo Tempest (Citation: Microsoft Threat Actor Naming July 2023)
Roasted 0ktapus (Citation: CrowdStrike Scattered Spider BYOVD January 2023)
Storm-0875 (Citation: Microsoft Threat Actor Naming July 2023)

Techniques Used
Domain ID Name Use
Enterprise T1087 .002 Account Discovery: Domain Account

Scattered Spider leverages legitimate domain accounts to gain access to the target environment.(Citation: CISA Scattered Spider Advisory November 2023)(Citation: MSTIC Octo Tempest Operations October 2023)
Enterprise T1098 .003 Account Manipulation: Additional Cloud Roles

During C0027, Scattered Spider used IAM manipulation to gain persistence and to assume or elevate privileges.(Citation: Crowdstrike TELCO BPO Campaign December 2022) Scattered Spider has also assigned user access admin roles in order to gain Tenant Root Group management permissions in Azure.(Citation: MSTIC Octo Tempest Operations October 2023)
Enterprise T1213 .003 Data from Information Repositories: Code Repositories

Scattered Spider enumerates data stored within victim code repositories, such as internal GitHub repositories.(Citation: CISA Scattered Spider Advisory November 2023)(Citation: MSTIC Octo Tempest Operations October 2023)
.005 Data from Information Repositories: Messaging Applications

Scattered Spider threat actors search the victim’s Slack and Microsoft Teams for conversations about the intrusion and incident response.(Citation: CISA Scattered Spider Advisory November 2023)

Enterprise T1484 .002 Domain or Tenant Policy Modification: Trust Modification

Scattered Spider adds a federated identity provider to the victim’s SSO tenant and activates automatic account linking.(Citation: CISA Scattered Spider Advisory November 2023)
Enterprise T1567 .002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Scattered Spider has exfiltrated victim data to the MEGA file sharing site.(Citation: CISA Scattered Spider Advisory November 2023)(Citation: MSTIC Octo Tempest Operations October 2023)
Enterprise T1564 .008 Hide Artifacts: Email Hiding Rules

Scattered Spider creates inbound rules on the compromised email accounts of security personnel to automatically delete emails from vendor security products.(Citation: MSTIC Octo Tempest Operations October 2023)
Enterprise T1556 .006 Modify Authentication Process: Multi-Factor Authentication

After compromising user accounts, Scattered Spider registers their own MFA tokens.(Citation: CISA Scattered Spider Advisory November 2023)
.009 Modify Authentication Process: Conditional Access Policies

Scattered Spider has added additional trusted locations to Azure AD conditional access policies. (Citation: MSTIC Octo Tempest Operations October 2023)

Enterprise T1578 .002 Modify Cloud Compute Infrastructure: Create Cloud Instance

During C0027, Scattered Spider used access to the victim's Azure tenant to create Azure VMs.(Citation: Crowdstrike TELCO BPO Campaign December 2022) Scattered Spider has also created Amazon EC2 instances within the victim's environment.(Citation: CISA Scattered Spider Advisory November 2023)
Enterprise T1003 .003 OS Credential Dumping: NTDS

Scattered Spider has extracted the `NTDS.dit` file by creating volume shadow copies of virtual domain controller disks.(Citation: MSTIC Octo Tempest Operations October 2023)
Enterprise T1598 .004 Phishing for Information: Spearphishing Voice

During C0027, Scattered Spider used phone calls to instruct victims to navigate to credential-harvesting websites.(Citation: Crowdstrike TELCO BPO Campaign December 2022) Scattered Spider has also called employees at target organizations and compelled them to navigate to fake login portals using adversary-in-the-middle toolkits.(Citation: MSTIC Octo Tempest Operations October 2023)
Enterprise T1021 .007 Remote Services: Cloud Services

During C0027, Scattered Spider used compromised Azure credentials for credential theft activity and lateral movement to on-premises systems.(Citation: Crowdstrike TELCO BPO Campaign December 2022) Scattered Spider has also leveraged pre-existing AWS EC2 instances for lateral movement and data collection purposes.(Citation: CISA Scattered Spider Advisory November 2023)
Enterprise T1553 .002 Subvert Trust Controls: Code Signing

Scattered Spider has used self-signed and stolen certificates originally issued to NVIDIA and Global Software LLC.(Citation: CrowdStrike Scattered Spider BYOVD January 2023)
Enterprise T1552 .001 Unsecured Credentials: Credentials In Files

Scattered Spider Spider searches for credential storage documentation on a compromised host.(Citation: CISA Scattered Spider Advisory November 2023)
.004 Unsecured Credentials: Private Keys

Scattered Spider enumerate and exfiltrate code-signing certificates from a compromised host.(Citation: CISA Scattered Spider Advisory November 2023)

Software
ID Name References Techniques
S0508 ngrok (Citation: CISA Scattered Spider Advisory November 2023) (Citation: Cyware Ngrok May 2019) (Citation: FireEye Maze May 2020) (Citation: MalwareBytes LazyScripter Feb 2021) (Citation: Zdnet Ngrok September 2018) Domain Generation Algorithms, Exfiltration Over Web Service, Protocol Tunneling, Proxy, Web Service
S1068 BlackCat (Citation: ACSC BlackCat Apr 2022) (Citation: ALPHV) (Citation: CISA Scattered Spider Advisory November 2023) (Citation: MSTIC Octo Tempest Operations October 2023) (Citation: Microsoft BlackCat Jun 2022) (Citation: Noberus) (Citation: Sophos BlackCat Jul 2022) Windows Management Instrumentation, System Owner/User Discovery, Bypass User Account Control, Service Stop, Domain Account, Domain Groups, Network Share Discovery, Windows File and Directory Permissions Modification, System Information Discovery, Modify Registry, Clear Windows Event Logs, File and Directory Discovery, Internal Defacement, Data Encrypted for Impact, Lateral Tool Transfer, Windows Command Shell, Access Token Manipulation, Remote System Discovery, Inhibit System Recovery, Disk Content Wipe
S0002 Mimikatz (Citation: Adsecurity Mimikatz Guide) (Citation: CISA Scattered Spider Advisory November 2023) (Citation: Deply Mimikatz) (Citation: MSTIC Octo Tempest Operations October 2023) Security Account Manager, LSA Secrets, Credentials from Password Stores, Security Support Provider, Rogue Domain Controller, Credentials from Web Browsers, Private Keys, LSASS Memory, Golden Ticket, Pass the Ticket, Steal or Forge Authentication Certificates, Account Manipulation, SID-History Injection, Silver Ticket, Windows Credential Manager, Pass the Hash, DCSync
S0349 LaZagne (Citation: GitHub LaZagne Dec 2018) (Citation: GitHub LaZange Dec 2018) (Citation: MSTIC Octo Tempest Operations October 2023) Keychain, LSA Secrets, Proc Filesystem, Credentials from Password Stores, Credentials from Web Browsers, LSASS Memory, Cached Domain Credentials, Credentials In Files, /etc/passwd and /etc/shadow, Windows Credential Manager
S0670 WarzoneRAT (Citation: Ave Maria) (Citation: CISA Scattered Spider Advisory November 2023) (Citation: Check Point Warzone Feb 2020) (Citation: Uptycs Warzone UAC Bypass November 2020) VNC, Keylogging, Rootkit, Bypass User Account Control, Hide Artifacts, Malicious File, Symmetric Cryptography, Spearphishing Attachment, System Information Discovery, Native API, Data from Local System, Deobfuscate/Decode Files or Information, Process Injection, Modify Registry, Credentials from Web Browsers, Video Capture, Proxy, File and Directory Discovery, Process Discovery, Exfiltration Over C2 Channel, PowerShell, Registry Run Keys / Startup Folder, Disable or Modify Tools, Component Object Model Hijacking, Non-Application Layer Protocol, Hidden Window, Windows Command Shell, Template Injection, Ingress Tool Transfer, Remote Desktop Protocol

References

  1. Trellix et. al.. (2023, August 17). Scattered Spider: The Modus Operandi. Retrieved March 18, 2024.
  2. Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
  3. CrowdStrike. (n.d.). Scattered Spider. Retrieved July 5, 2023.
  4. CrowdStrike. (2023, January 10). SCATTERED SPIDER Exploits Windows Security Deficiencies with Bring-Your-Own-Vulnerable-Driver Tactic in Attempt to Bypass Endpoint Security. Retrieved July 5, 2023.
  5. CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.
  6. Microsoft. (2023, October 25). Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction. Retrieved March 18, 2024.
  7. Parisi, T. (2022, December 2). Not a SIMulation: CrowdStrike Investigations Reveal Intrusion Campaign Targeting Telco and BPO Companies. Retrieved June 30, 2023.
Навигация

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.