{"id":1235,"date":"2024-10-20T18:39:43","date_gmt":"2024-10-20T13:09:43","guid":{"rendered":"https:\/\/nocturnalknight.co\/?p=1235"},"modified":"2024-10-20T18:39:43","modified_gmt":"2024-10-20T13:09:43","slug":"scattered-spider-attacks-tips-for-saas-security","status":"publish","type":"post","link":"http:\/\/3.10.118.248\/?p=1235","title":{"rendered":"Scattered Spider Attacks: Tips for SaaS Security"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

As cloud adoption soars, threat groups like LUCR-3<\/a> Scattered Spider and Oktapus are mastering new ways to exploit identity management systems(IAMs), making these attacks more frequent and harder to detect. By targeting cloud environments and leveraging human vulnerabilities, LUCR-3 compromises identity providers (IDPs) and uses sophisticated techniques to breach organizations.<\/p>\n\n\n\n

Before we begin, I wanted to present a random sampling of the successful attacks carried over by the LUCR-3 aka Scattered Spider.<\/p>\n\n\n\n

Company\/Product<\/strong><\/th>Date Attacked<\/strong><\/th>Compromised System<\/strong><\/th>Projected Loss<\/strong><\/th>Mitigation Time<\/strong><\/th><\/tr><\/thead>
Telecom Company (Unnamed)<\/strong><\/td>December 2022<\/td>Mobile Carrier Network, IDP Systems<\/td>Estimated millions in damages<\/td>Several weeks (ongoing)\u200bCrowdStrike<\/a><\/td><\/tr>
Octa (Roasted Oktapus)<\/strong><\/td>March 2022<\/td>Identity Provider (Okta) and SaaS<\/td>Potential damage to ~366 companies<\/td>4-5 weeks\u200bHero<\/a>\u200bWikipedia<\/a><\/td><\/tr>
British Telecommunications<\/strong><\/td>June 2022<\/td>Mobile Carrier Systems, BPO Networks<\/td>Millions in lost revenue<\/td>3-4 weeks\u200bCrowdStrike<\/a>\u200bHero<\/a><\/td><\/tr>
Gaming Company (Unnamed)<\/strong><\/td>September 2022<\/td>Cloud Infrastructure (SaaS and IaaS)<\/td>Losses in IP theft (unconfirmed)<\/td>~2 weeks\u200bISPM ITDR<\/a><\/td><\/tr>
Cloud Hosting Provider<\/strong><\/td>November 2022<\/td>AWS, Azure Environments, IAM Systems<\/td>IP theft and reputational damage<\/td>3 weeks\u200bCrowdStrike<\/a><\/td><\/tr>
MGM Resorts<\/strong><\/td>September 2023<\/td>Corporate systems, Help Desk, and IDP<\/td>Millions in lost revenue<\/td>Systems offline for weeks\u200bWikipedia<\/a><\/td><\/tr>
Caesars Entertainment<\/strong><\/td>September 2023<\/td>Identity Providers (IDP) and SaaS<\/td>~$30 million ransom paid\u200b Wikipedia<\/a><\/td>~1 month recovery\u200bCyber Defense Magazine<\/a><\/td><\/tr>
Charter Communications<\/strong><\/td>April 2024<\/td>Cloud-based systems (Okta phishing)<\/td>Potentially millions in damages\u200b Resilience<\/a><\/td>Several weeks<\/td><\/tr>
NHS Hospitals (UK)<\/strong><\/td>June 2024<\/td>VMware ESXi servers, critical healthcare systems<\/td>Disruption of hundreds of operations\u200bBleepingComputer<\/a><\/td>Ongoing\u200bBleepingComputer<\/a><\/td><\/tr>
Synnovis Pathology Services<\/strong><\/td>June 2024<\/td>Ransomware on pathology services systems<\/td>Estimated millions in healthcare disruptions\u200bBleepingComputer<\/a><\/td>Ongoing investigation\u200bBleepingComputer<\/a><\/td><\/tr><\/tbody><\/table>
This table provides a detailed overview of Scattered Spider\u2019s recent attacks across industries, demonstrating their evolving tactics and widespread impact.<\/figcaption><\/figure>\n\n\n\n

This article outlines the technical steps LUCR-3 typically follows, from initial access to persistence and lateral movement within cloud environments, mostly targeting SaaS platforms.<\/p>\n\n\n\n

Step 1: Initial Access Through Identity Compromise<\/strong><\/h3>\n\n\n\n

LUCR-3 starts with a core weakness in modern security\u2014identity management<\/strong>. Their main attack vectors include:<\/p>\n\n\n\n

    \n
  1. SIM Swapping<\/strong>: LUCR-3 hijacks a user\u2019s phone number by tricking the telecom provider into assigning the number to a new SIM card. Once they have control over the phone number, they can intercept One-Time Passwords (OTP)<\/strong> sent via SMS.<\/li>\n\n\n\n
  2. MFA Fatigue<\/strong>: The attackers flood the target with repeated MFA prompts, often overwhelming them into approving a malicious login request.<\/li>\n\n\n\n
  3. Phishing and Social Engineering<\/strong>: They set up fake login pages for SaaS applications (e.g., SharePoint or OneDrive), capturing legitimate credentials and OTP codes.<\/li>\n<\/ol>\n\n\n\n

    These techniques allow LUCR-3 to bypass standard Multi-Factor Authentication (MFA)<\/strong> protections and gain access to cloud environments\u200b<\/p>\n\n\n\n

    ISPM ITDR<\/a>, Hero<\/a>.<\/p>\n\n\n\n

    Step 2: Bypassing MFA and Establishing a Foothold<\/strong><\/h3>\n\n\n\n

    Once inside, LUCR-3 focuses on maintaining access to the compromised identity. This is done by modifying the victim’s MFA settings. Their tactics include:<\/p>\n\n\n\n