The ITSM Practice Podcast: Exploring Scattered Spider Cloud Attacks

Luigi Ferry:
Welcome to the ITSM Practice Podcast. I’m Luigi Ferry, your host. Today, I’m handing over the reins to Tarun Ramesh, a cloud security expert and software developer at Dune Security.

Have you ever wondered how sophisticated cyberattacks unfold in the cloud? Tarun is here to shed light on that. He’ll touch on the challenges of securing cloud environments and offer insights on enhancing incident response strategies.

Curious about how to better protect your digital assets? Stay tuned as Tarun guides us through the essentials of cybersecurity in cloud computing.

Now, let’s get started with Tarun and uncover some critical cybersecurity insights.

Tarun Ramesh:
Thank you for having me on the podcast. I’m excited to dive into the Scattered Spider attack on cloud environments, focusing on the use of social engineering, how they maintain persistence, and what organizations can do to prevent these types of attacks and enhance incident response.

Scattered Spider’s attack on cloud-hosted virtual machines was highly effective due to its sophisticated social engineering tactics aimed at highly privileged users like IT administrators. The group used phishing, vishing, push bombing, and SIM swapping to manipulate employees into revealing credentials or granting access.

After gaining initial access, the attackers registered their own MFA tokens and added federated identity providers, granting them persistent access to the cloud environments. They also registered unauthorized virtual machines that bypassed security tools, allowing them to remain undetected.

Scattered Spider leveraged legitimate cloud tools designed for administrative use, because these tools allow them to operate within the normal framework of cloud environments. This approach enabled them to execute commands, move data, and maintain persistence without raising suspicion.

By using these legitimate tools, they could blend their actions with routine administrative tasks, making it much harder for traditional security measures—which often rely on detecting abnormal or unauthorized activity—to identify their malicious actions.

Scattered Spider exploited federated identity providers by adding their own to the victim’s tenant. This enabled automatic account linking across systems, maintaining access even after compromised accounts were discovered.

Organizations can secure their environments by regularly auditing added identity providers, enforcing strict MFA policies, and disabling automatic account linking unless explicitly necessary.

Cloud environments pose unique challenges due to the variety of services and tools that can be exploited by attackers. Scattered Spider used legitimate cloud tools to avoid detection, taking advantage of this complexity. Security teams should enable comprehensive logging across cloud services, use cloud-native SIEM tools, and apply behavior analytics to detect unusual activity. Regular audits and maintaining visibility into cloud infrastructure changes are essential.

Incident response planning is crucial for cloud environments due to the fast-paced nature of cloud operations, which makes large-scale attacks more likely. Organizations should include clear protocols for detecting and responding to credential-based attacks, cloud misconfigurations, and lateral movement.

Regular tabletop exercises simulating cloud-based attacks are essential to ensure swift and effective responses. Cloud-specific detection and response tools, along with trained cloud security personnel, are key components of an effective incident response plan.

Strict MFA policies, especially for high-privileged accounts, would have made it much harder for Scattered Spider to establish persistence. Regular auditing of account privileges and federated identity providers is also critical. Organizations should use cloud security posture management tools to detect misconfigurations and enforce network segmentation to limit the impact of compromised accounts.

Deploying EDR on all virtual machines, including newly created ones, would also help prevent attackers from remaining undetected. Additionally, automated policy correction based on usage patterns would have been a valuable defense. By continuously analyzing the normal behavior of users and resources, automated systems could detect deviations and automatically adjust policies to close potential gaps.

For example, if an account begins to behave unusually, such as accessing systems it typically doesn’t, automated systems could reduce that account’s privileges or revoke access entirely, reducing the attack surface in real time. This proactive approach would help minimize the window of opportunity for attackers to exploit misconfigurations or stolen credentials.

Organizations must prioritize strong MFA for all accounts, particularly for privileged users. Investing in cloud-native security solutions such as cloud workload protection platforms and SIEM tools is essential for real-time monitoring and alerts. Detection capabilities should focus on analyzing user behavior to identify unusual patterns.

Upskilling security teams to better understand cloud environments and regularly testing incident response plans tailored to cloud-based threats are also crucial.

Scattered Spider’s use of social engineering and legitimate cloud tools underscores the critical need for modern, adaptive security practices in cloud environments. One powerful strategy is automated policy correction, which allows organizations to continuously monitor behavior, detect anomalies, and adjust security policies in real time.

This proactive approach not only helps mitigate threats but also strengthens overall cloud defenses. By investing in cloud security posture management with automated correction capabilities, organizations can stay ahead of sophisticated attacks in today’s rapidly evolving threat landscape.

Vigilance, automation, and adaptability are key to maintaining a strong security posture.

Thank you for listening, and I hope this discussion has offered valuable insights into securing cloud environments against emerging threats.