TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

CyberScoop

Two new extortion crews are speedrunning the Scattered Spider playbook

Matt Kapko · 6 days ago · Read original ↗

ATT&CK techniques detected

4 predictions
T1090.002External Proxy
68%
"ip - based detection and blend in with typical traffic. residential proxy networks, which rely on ip addresses assigned to real home users, can serve a legitimate purpose, but researchers have been warning that unethical or outright criminal operators are abusing these networks t…"
T1566.002Spearphishing Link
68%
"can expose data in other connected services beyond the initial breach point, it ’ s difficult to determine how many victims have been caught up in these campaigns. crowdstrike ’ s warning closely follows research palo alto networks ’ unit 42 and the retail & hospitality informati…"
T1657Financial Theft
59%
"two new extortion crews are speedrunning the scattered spider playbook a pair of persistent and problematic threat groups affiliated with the com are actively targeting organizations across multiple critical infrastructure sectors for rapid data theft and extortion attacks, accor…"
T1598Phishing for Information
41%
"can expose data in other connected services beyond the initial breach point, it ’ s difficult to determine how many victims have been caught up in these campaigns. crowdstrike ’ s warning closely follows research palo alto networks ’ unit 42 and the retail & hospitality informati…"

Summary

CrowdStrike says The Com-affiliated threat groups are using voice phishing and fake SSO pages to break into SaaS environments and steal data fast for extortion.

The post Two new extortion crews are speedrunning the Scattered Spider playbook appeared first on CyberScoop.