Scattered Spider Adapts to Evolving Threat Landscaped

As Arete reported in last week’s article, RansomHub emerged as a new Ransomware-as-a-Service (RaaS) operation in early 2024 and has already targeted several high-profile victims, including telecom giant Frontier Communications and Christie’s auction house. According to a recent analysis, at least one affiliate of RansomHub is a present or former member of the Scattered Spider threat group and previously worked with ALPHV/BlackCat prior to its shutdown. According to the report, the RansomHub affiliate was observed using the same tools, tactics, and techniques previously used by a Scattered Spider threat actor.   

• These tools include ngrok for remote access, remote desktop client Remmina, and Tailscale virtual private network (VPN) service.
• Similar tactics included the use of social engineering by individuals with American accents to manipulate victims into resetting account passwords. 

Scattered Spider: #OpenToWork      

Scattered Spider—also known by several other names, including Octo Tempest, Oktapus, Scattered Swine, and UNC3944—is a sophisticated threat group that has been active since at least May 2022. The group is known to conduct solo exfiltration-based extortion attacks and work within the affiliate structure of the now-defunct ALPHV RaaS. As an affiliate of ALPHV, Scattered Spider gained notoriety after its alleged attack on Caesars Entertainment and MGM Resorts in late 2023.  

Law enforcement operations against ALPHV in December 2023 eventually led to the RaaS group shutting down its operations in March 2024. RansomHub was one of the emerging RaaS groups that took advantage of the pool of ex-ALPHV affiliates and began posting recruiting advertisements on Dark Web forums that referenced ALPHV’s struggles and offered a generous 90/10 payment split for new affiliates. 

Evolving Tactics – Scattered Spider Getting SaaSy  

In addition to Scattered Spider reportedly aligning with RansomHub, separate reporting indicated that the group has been focusing on data theft extortion without using ransomware, expanding tactics to include data theft from software-as-a-service (SaaS) applications. In the past, Scattered Spider was known to leverage compromised credentials and social engineering attacks via phishing and SIM swapping to gain access to victim networks. However, Scattered Spider threat actors recently shifted to using stolen credentials to access SaaS applications, including vCenter, CyberArk, SalesForce, Azure, CrowdStrike, Amazon Web Service (AWS), and Google Cloud Platform (GCP). After gaining access to a victim’s environment, they use legitimate cloud syncing tools to move victim data to services like AWS and GCP.  

Analyst Comments  

Law enforcement operations against large RaaS groups like ALPHV and LockBit in 2024 created a fractured ransomware landscape, but groups like Scattered Spider are finding ways to adapt their operations and tactics. Although recent reports seem to portray conflicting tactics of data theft and ransomware, both are aligned with previous Scattered Spider operations. The group remains opportunistic, operating independently in data theft-only attacks, as well as aligning with RaaS groups. Given RansomHub’s focus on recruiting ex-APLHV affiliates, it makes sense that Scattered Spider would pivot between affiliate structures and work with the emerging RaaS, particularly given the lucrative affiliate terms promised on RansomHub’s recruitment posts. Although its tactics or affiliations may shift, Scattered Spider will likely remain a dynamic threat group and pivot to the opportunities that meet its evolving needs.   

Sources  

• GuidePoint Security – Worldwide Web: An Analysis of Tactics and Techniques Attributed to Scattered Spider 

• GuidePoint Security – T-O-X-I-N-B-I-O – Ransomware Recruitment Efforts Following Law Enforcement Disruption    

• BleepingComputer – Scattered Spider hackers switch focus to cloud apps for data theft 

• Google Cloud – UNC3944 Targets SaaS Applications 

• CISA – Scattered Spider