Scattered Spider: The Modus Operandi

🗓️ 17 Aug 2023 00:00:00Reported by TrellixType

Scattered Spider, financially motivated threat actor, targets telecom, BPO, and critical infrastructure orgs using social engineering, SMS phishing and SIM swapping. Leverages signed but malicious Windows Intel Ethernet diagnostics driver. Exploits CVE-2015-2291, uses STONESTOP and POORTRY for security software termination, Azure environment, various remote access tools. Involved in incidents targeting high-value cryptocurrency institutions, performs SIM swapping, and deploys ransomware

Reporter	Title	Published	Views	Family All 75
zdt	Intel Network Adapter Diagnostic Driver - IOCTL Handling Vulnerability	20 Mar 201500:00	–	zdt
zdt	ForgeRock Access Manager / OpenAM 14.6.3 - Remote Code Execution (Unauthenticated) Exploit	16 Jul 202100:00	–	zdt
githubexploit	Exploit for Deserialization of Untrusted Data in Forgerock Access_Management	1 Jul 202103:51	–	githubexploit
githubexploit	Exploit for Improper Input Validation in Intel Ethernet_Diagnostics_Driver_Iqvw32.Sys	22 Feb 202013:27	–	githubexploit
githubexploit	Exploit for Improper Input Validation in Intel Ethernet_Diagnostics_Driver_Iqvw32.Sys	18 Jan 202604:05	–	githubexploit
githubexploit	Exploit for Improper Input Validation in Intel Ethernet_Diagnostics_Driver_Iqvw32.Sys	25 Jan 202602:03	–	githubexploit
ics	2021 Top Routinely Exploited Vulnerabilities	28 Apr 202212:00	–	ics
attackerkb	CVE-2026-33439	7 Apr 202620:46	–	attackerkb
attackerkb	Pre-auth RCE in ForgeRock Access Manager (CVE-2021-35464)	22 Jul 202100:00	–	attackerkb
attackerkb	CVE-2015-2291	9 Aug 201700:00	–	attackerkb