Recently Scattered Spider (G1015) have been gathering attention from a range of attacks against UK retail, namely attacks against Marks and Spencer, Harrods and Co-Op. These have led to extensive service disruption, with some firms being able to limit the impacts caused more than others. This is in addition to a range of attacks in previous years against telecommunication and Business Process Outsourcing (BPO) providers. Given the impact felt by the recent attacks against retail firms, understandably other businesses want to assess their defences against such attacks.
Threat Intelligence
To start, let’s summarise the TTPs of Scattered Spider from public threat intelligence sources, along with some ideas on how these can be tested safely. I will focus heavily on the initial stages of a Scattered-Spider attack, as this is the typical focus for most companies, though reviewing the post-exploitation TTPs would also be advisable!
MITRE ATT&CK
Starting with MITRE ATT&CK, under the Scattered Spider group ID of G1015, we can use the MITRE ATT&CK Navigator alongside the MITRE ATT&CK G1015 data, to observe see several TTPs from the threat intelligence ingested by MITRE.
- Phishing for Information: Spearphishing Service (
T1598.001) - Phishing for Information: Spearphishing Voice (
T1598.004) - Gather Victim Identity Information: Credentials (
T1589.001) - Exploit Public Facing Application (
T1190) - External Remote Services (
T1133) - Phishing: Spearphishing Voice (
T1566.004) - Valid Accounts: Cloud Accounts (
T1078.004)
FS-ISAC
FS-ISAC released an advisory in 2023, which detailed a range of social engineering vectors, which would link with Co-Op’s recommendation for all staff to have cameras on in meetings; a likely sign that vishing or impersonation was a direct tactic used in 2025. The report lists a range of TTPs:
- Gather Victim Identity Information: Credentials (
T1589.001) - Phishing: Spearphishing Voice (
T1566.004)- Specifically targeting the IT Helpdesk
- Multi-Factor Authentication Request Generation (
T1621)- Otherwise known as MFA Bombing or MFA Fatigue
- (SMS) Phishing (
T1660) - SIM Card Swap (
T1451) - Acquire Infrastructure: Domains (
T1583.001) - Account Manipulation: Device Registration (
T1098.005)
The report also lists Bring-Your-Own Vulnerable Driver (BYOVD) as a TTP, which could be considered for testing, or ensuring that BYOVD-specific controls are enabled, such as the corresponding ASR rule in MDE.
Google/Mandiant
A recent Mandiant report lists a range of TTPs which mirror the above, with a handy diagram (below) which shows a graphical mapping of the TTPs across the attack chain.
Some of the notable TTPs are:
- (SMS) Phishing (
T1660) - SIM Card Swap (
T1451) - Phishing: Spearphishing Voice (
T1566.004)- Specifically targeting the IT Helpdesk
- Remote Access Tools: Remote Desktop Software (
T1219.002)
Notably there are a lot of other lower-skilled TTPs listed here, such as using Mimikatz and secretsdump.py, which should be readily detected by any EDR.
CISA
In 2023, CISA produced a report on Scattered Spider activity with the following TTPs:
- (SMS) Phishing (
T1660) - SIM Card Swap (
T1451) - Phishing: Spearphishing Voice (
T1566.004)- Specifically targeting the IT Helpdesk
- Remote Access Tools: Remote Desktop Software (
T1219.002)- Noted tools included Pulseway, ScreenConnect, TeamViewer.
- Multi-Factor Authentication Request Generation (
T1621)
Following a successful vish or phish of a user, Scattered Spider were observed to then perform more detailed OSINT into the targets, looking to identify potential answers to their security questions or perform targeted SIM swapping attacks.
Other
Scattered Spider has also been observed to register domains using the *.it.com domain, along with various domains relating to potential targets, such as corp-TARGET_HERE.com, which is also noted by CISA.
Testing Approach
From the above threat intelligence, it is clear to see several common approaches taken by Scattered Spider, specifically around vishing and the widespread use of social engineering tactics. To assess this, there are several different attacks which can be simulated through either a red or purple team exercise.
Vishing
The main TTP used by Scattered Spider appears to be the use of vishing to gain access to their targets. As part of this, the following could be tested:
- Vishing the IT Support helpdesk to gain a password and/or MFA reset
- This should include both a ‘standard’ and ‘privileged’ user as targets
- Assess controls in place on video calling and internal messaging applications
- Can an external Teams user directly message/call employees?
- Are external tenants only to communicate internally following approval?
- Can the SOC correlate the activity from an IT Helpdesk call to any malicious behaviour (I.e. MFA Methods added or unusual account activity)
- Perform vishing attacks directly against high-profile or privileged users
- Currently this is not listed by any public TI sources, but would be a logical next step for Scattered Spider TTPs
- This would have to be carefully planned with considered guardrails and limitations to prevent causing harm or distress to any users.
Performing internal vishing (E.g. social engineering a user from the position of another internal user) can be challenging during a purple team exercise, due to the lack of technical controls which can be implemented to prevent otherwise legitimate behaviour. Instead, this can be somewhat simulated by attempting some of the ‘Risky Sign In’ behaviour below. For example, by simulating the theft of valid credentials, and attempting to authenticate as a secondary account. This would simulate the stages before an internal vishing attack, as the attacker gains access to the internal environment.
Another approach could be to simulate a supply chain compromise, from the position of a IT provider/supplier being compromised. By configuring a separate (trusted) tenant, and then creating an account within it to simulate a third party user or contractor. This could be a privileged account, or simply a ‘standard’ account, which is within a tenant that has a level of trust into the main tenant. Several tests could then be performed from the trusted into the trusting tenant:
- Performing vishing and phishing attacks
- Such as sharing a link to a credential capture portal, sending various payloads via email or Teams
- Throughout these TTPs, the behaviour of email and web filtering and gateway solutions should be checked for any discrepancies compared to the same behaviour performed from an ‘untrusted’ account.
- Credential re-use onto SSO-enabled platforms such as Citrix, AVDs or other internal systems
- Enumeration of shared cloud resources or internal data repositories
Credential Capture
Scattered Spider appear to make extensive use of credential capture sites, such as those created by Evilginx. These sites are often hosted using domains which mimic the brand being targeted, which could act as another point of detection. Some potential tests include:
- Phishing using a credential capture lure
- Sending credential capture payloads from a domain impersonating the target (e.g.
auth-TARGET_NAME.com) - Assessing that alerts are raised following credential capture activity
- This can be performed using specific detections such as CSS-based Canary Tokens
- Additionally there are some identity-based detections which can be raised
- Registering domains which impersonate the target to test brand protection controls and/or typo-squatting detections
This can also blur into testing ‘risky sign-in’ activity, such as performing signins from non-compliant hosts or those in unusual geographies. This can be performed by:
- Using VPS’s in unusual geographies to simulate a foreign login
- Testing ‘impossible travel’
- Authenticating using an abnormal host or browser/user agent (E.g. Kali Linux, Firefox)
- Authenticating following an MFA Fatigue attack (See later!)
- Performing a secondary authentication whilst the user is legitimately signed in.
Credential Re-Use
Credential stuffing or re-use attacks appear to also be used by Scattered Spider, along with a number of other threat actors. Whilst this is a commonly used technique, there are several password spraying TTPs which are worth assessing:
- Evaluate breached credentials and combolists for leaked credentials
- Depending on the scope and appetite of the customer, performing more targeted OSINT into high profile or privileged users to identify passwords used on personal accounts could be performed – subject to approval!
- Perform targeted password spraying using any leaked credentials, including potential modifications (E.g.
London101!->London102!) - Widespread password spraying using passwords relating to the company or industry
With access to a valid account, a wider range of tests can be simulated as an assumed compromise-style test to assess the post-authentication controls:
- Attempt to add phone/SMS based MFA methods to an account
- If they are, then perform MFA Fatigue tests against it.
- Sign in using a non-compliant device
- Attempt to perform typical early kill chain behaviour
- Searching SharePoint/internal resources for passwords or internal data
- Gathering of Teams and Outlook data
- Add new MFA methods to the account
- Change the password of the account
- Follow the ‘Risky Sign In’ activity above
- Evaluation of the current password policy and banned password phrases
Remote Management and Monitoring (RMM)
Attempting to download and install various RMM tools on a corporate device should be sufficient to raise alerts, especially if the executable is not being installed via an approved method (E.g. InTune). CISA has a specific advisory on this, which contains additional information.
For some (or all!) of the RMM software mentioned by RedCanary, you could:
- Attempt to download the RMM software
- Install the RMM software
- Establish a remote connection to the host
- Attempt to run various commands through a provided console (If it has one) or through
cmd/powershell.
Alerts could be raised at all points of these tests, though this can be challenging due to the executables potentially being allowed by policy, for example of AnyConnect is a corporate solution for screensharing or client communications. It would also be a good exercise to ensure any actions performed via a RMM can be successfully attributed to a RMM session by the SOC/IR teams, rather than a more generic attribution to activity via a CLI.
Additional Considerations
Whilst the TI mentioned above lists a range of TTPs, it is also important to consider some of the emerging initial access tradecraft seen by other threat actors, such as Device Code phishing, ClickFix and Living Off Trusted Sites (LOTS). Whilst I dont believe this has been publicly observed as being used by Scattered Spider yet, given the success of such techniques it would be advised to ensure these are also tested, as the TTPs in use may evolve!
A lot of this post focuses on technical controls and testing, but this activity also has a number of potential table top scenarios which could be produced from it to ensure the correct processes are in place. For example:
- How would a third-party compromise be handled in light of the recent breaches?
- What would the process be for handling AiTM alerts being raised against a privileged IT account?
- What would the response be if a mass password-spraying attack was observed from known Scattered Spider infrastructure?
Specific training or guidance for staff may be sensible given the uptick in active attacks from Scattered Spider recently. Training could focus on:
- How to identify potential social engineering approaches, focusing on vishing specifically
- How can users report suspicious internal messages or video calls
- Raising awareness of current attacker trends, such as ClickFix
Recommendations
The FS-ISAC report and the Mandiant report have a range of recommendations on specific controls to be implemented, and would be a good starting point for any assurance activity.