MSTIC Octo Tempest Operations October 2023

Scattered Spider has extracted the `NTDS.dit` file by creating volume shadow copies of virtual domain controller disks.

Scattered Spider has created volume shadow copies of virtual domain controller disks to extract the `NTDS.dit` file.

Scattered Spider Spider enumerates a target organization for files and directories of interest, including source code, user provisioning, MFA device registration, network diagrams, and shared credentials in documents or spreadsheets.

Scattered Spider has enumerated legitimate domain accounts which are used in the targeted environment.

Scattered Spider has assigned user access admin roles in order to gain Tenant Root Group management permissions in Azure.

Scattered Spider enumerates data stored within victim code repositories, such as internal GitHub repositories.

Scattered Spider has used BlackCat and DragonForce ransomware to encrypt files including on VMWare ESXi servers.

Scattered Spider has added additional trusted locations to Azure AD conditional access policies.

Scattered Spider creates inbound rules on the compromised email accounts of security personnel to automatically delete emails from vendor security products.

Scattered Spider has exfiltrated victim data to the MEGA file sharing site, SnowFlake, and AWS S3 buckets.

Scattered Spider enumerates cloud environments including Amazon Web Services (AWS) S3 buckets to identify server and backup management infrastructure, resource access, databases and storage containers .

Scattered Spider has used help desk voice-based phishing and also called employees at target organizations and compelled them to navigate to fake login portals using adversary-in-the-middle toolkits.

Scattered Spider utilized social engineering to compel IT help desk personnel to reset passwords and MFA tokens. Scattered Spider has also used Microsoft Teams to pose as internal IT support or help desk personnel.