Cloud Warfare: Grappling and Strangling Scattered Spider

Cloud Warfare: Grappling and Strangling Scattered Spider

Speakers: Andi Ahmeti (Associate Threat Researcher, Permiso Security); Abian Morina (Associate Threat Researcher, Permiso Security)

Conference: BSides NYC

YouTube: https://www.youtube.com/watch?v=xKxZabbM4wA

Overview

In the dynamic landscape of cloud security, threat actors continually evolve their tactics, techniques, and procedures (TTPs) to bypass traditional defenses. The talk "Cloud Warfare: Grappling and Strangling Scattered Spider" by Andi Ahmeti and Abian Morina, Associate Threat Researchers at Permiso Security, delves into the sophisticated operations of a prominent financially motivated threat actor group, known by various monikers including Scattered Spider, Octopus, and LUCRE3 (Permiso's internal designation). This presentation offers a comprehensive analysis of their modern cloud attack methodologies, with a particular focus on their activities within Amazon Web Services (AWS) environments.

The speakers meticulously dissect Scattered Spider's evolution, their relentless pursuit of financial gain, and the specific TTPs they employ across Identity Providers (IDPs), Software-as-a-Service (SaaS) platforms, and Infrastructure-as-a-Service (IaaS) environments. A significant portion of the talk is dedicated to empowering defenders by outlining crucial log analysis strategies and introducing Cloud Grappler, an open-source threat detection framework developed by Permiso Security. This tool is designed to identify the tell-tale signs of Scattered Spider's presence, enabling organizations to proactively hunt and mitigate these advanced threats. The article will explore these critical aspects, providing a deep dive into the adversary's playbook and the defensive measures necessary to counter them effectively.

Background

▶ Watch: Introduction and agenda for the talk (0:00)

Scattered Spider, or LUCRE3 as designated by Permiso, represents a formidable and adaptable financially motivated threat actor. Their journey began with relatively low-stakes activities, such as Roblox gift card schemes, before escalating to crypto mining. However, their primary and most impactful focus has evolved into large-scale extortion, frequently demanding millions of dollars from victims. A defining characteristic of LUCRE3 is their extreme persistence; they are known to re-engage targets just three months after a successful extortion, leveraging past payments or increasing pressure on those who initially refused to pay.

Their targeting strategy has also evolved significantly over time. Initially, they focused on telecommunications companies, leveraging SIM swapping tactics to gain control of phone numbers. Following this, they shifted their attention to large software firms, aiming to steal code signing certificates and source code, which facilitated high-value extortion demands. As opportunities in the software sector diminished, they diversified into industries like gaming and healthcare, demonstrating a highly opportunistic approach. More recently, their targeting has become less predictable, simultaneously attacking multiple industries to maximize financial gain.

LUCRE3's operational methodology is characterized by meticulous reconnaissance and a preference for leveraging legitimate tools and services rather than relying heavily on malware in cloud and SaaS environments. They conduct targeted personas research, often focusing on three key roles:

1. Identity Admins: Individuals managing critical IDP systems like Azure AD and Okta, whose compromise grants extensive access.
2. Sysadmins: Targeted when the objective is service disruption, particularly in industries like gaming, as these individuals maintain operational continuity.
3. Security Folks: Often possessing elevated privileges and sometimes having whitelisted their own activities, making them attractive targets. LUCRE3 aims to make their presence known only when ready to extort.

A critical aspect of their TTPs is the extensive use of GUI tooling (Graphical User Interface), with minimal malware, especially in cloud and SaaS contexts. They are highly opportunistic, adapting to whatever tools and platforms a victim organization utilizes, whether it's Slack, Teams, Notion, or Confluence. Furthermore, they are keen observers, gathering intelligence on victim environments to refine their attack strategies.

A modern cloud attack, as described by the speakers, is interconnected, starting from the Identity Provider (IDP). Once initial access is gained, attackers focus on understanding the environment, moving into SaaS portals to query information like a regular user. This intelligence gathering phase is crucial before executing their mission, which could involve IaaS compromise, credential harvesting, data theft, or manipulating CI/CD pipelines for source code or certificate exfiltration.

In the IDP phase, LUCRE3's research extends to emulating victim access patterns, even logging in from the same ASN (Autonomous System Number) as the legitimate user. They utilize residential proxies to avoid triggering geographic or jurisdiction-based security rules, making it incredibly difficult to distinguish malicious logins from legitimate ones. Credential acquisition methods range from buying or bribing to setting up targeted phishing infrastructure. Even robust MFA solutions are not foolproof, as they employ SIM swaps, push-for-keep attacks, or even direct bribery to bypass hardware tokens. Once in, they quickly establish persistence by registering their own MFA (often switching to SMS) and setting new email addresses for password resets. Defenders are advised to look for anomalies in user behavior, such as switching phone platforms (e.g., Apple to Android) or rapidly changing device models (e.g., iPhone 15 to 11), as these patterns are rare for legitimate users.

For SaaS environments, the challenge lies in the absence of malware. Attackers utilize the same APIs and functions as legitimate users. Their initial post-IDP access often involves exploring knowledge sharing resources like wikis or Confluence. Specific search terms, such as "AKIA" (for AWS credentials) or "Shodan API" (to understand data enrichment scripts), reveal their intent. Monitoring user behavior for sudden, uncharacteristic application usage (e.g., a long-time employee suddenly using GitHub) is a key detection opportunity. Furthermore, LUCRE3 employs defense evasion tactics by setting up automated email deletion rules, often using less common filters like "body contains" to remove traces of their communication and activity.

Key Findings

▶ Watch: Understanding LUCRE3 (Scattered Spider) threat actor (3:07)

The talk "Cloud Warfare: Grappling and Strangling Scattered Spider" delivers several critical findings regarding the nature of modern cloud attacks and effective defensive strategies.

Firstly, a central finding is the highly adaptive and persistent nature of Scattered Spider (LUCRE3). Their evolution from basic gift card schemes to multi-million dollar extortion, coupled with their relentless pursuit of targets (often returning within three months), underscores their commitment to financial gain and their sophisticated operational model. This persistence necessitates a long-term, vigilant defensive posture.

Secondly, the presentation highlights a significant shift in adversary tactics: Scattered Spider's minimal reliance on traditional malware in cloud and SaaS environments. Instead, they extensively leverage legitimate tools, native cloud services, and standard APIs. This "living off the land" approach makes detection extremely challenging for security teams focused solely on signature-based malware detection, demanding a pivot towards behavioral analytics and deep log analysis.

Thirdly, the speakers identify specific, actionable TTPs employed by Scattered Spider across the entire modern attack chain—from Identity Providers (IDPs) to SaaS applications and IaaS platforms like AWS. This detailed breakdown, including their methods for persona emulation, MFA bypass, intelligence gathering via knowledge bases, and particular AWS service abuses (e.g., S3 Browser for IAM, Cloud Shell for secrets), provides defenders with concrete indicators of compromise (IoCs) and behavior.

Finally, the talk emphasizes the critical role of comprehensive logging and a robust detection framework. The introduction of Cloud Grappler serves as a key finding itself, demonstrating how a specialized, open-source tool can aggregate and correlate logs from diverse cloud environments (AWS, Azure, GCP) against known threat actor TTPs. This facilitates proactive hunting and detection, addressing the inherent challenges of abstract and delayed cloud logs. The ability to define custom queries and generate detailed reports further empowers defenders to tailor their detection efforts.

Technical Deep Dive

▶ Watch: Evolution of Scattered Spider's tactics and motivations (3:57)

Scattered Spider's operations within cloud environments, particularly AWS, are characterized by a series of specific and often subtle TTPs designed to blend with legitimate activity.

In AWS environments, their tactics include:

• S3 Browser Abuse: Attackers use S3 Browser, a GUI tool, for sensitive IAM functions such as creating new users, uploading or updating login profiles, or altering permissions. This is a significant red flag because these actions are typically performed through more auditable channels like the AWS CLI or the management console.
• SSM for Persistence: They leverage AWS Systems Manager (SSM) to run scripts, such as software inventory gathers, across all EC2 instances. Crucially, instead of one-time execution, they schedule these scripts to run every 30 minutes, maintaining a persistent presence and continuously collecting data on the environment.
• Secrets Manager Exploitation via Cloud Shell: A rare and highly suspicious activity is the extraction of secrets from AWS Secrets Manager using Cloud Shell. Attackers loop through secrets with the get secret value command to exfiltrate critical information, a method seldom seen in legitimate operations. They also use Cloud Shell for unauthorized file uploads and downloads.
• Instance Profile Manipulation: Attackers replace existing EC2 instance profiles to grant instances overly permissive roles, often utilizing a simple policy, thus elevating privileges for their compromised EC2 instances.
• Covert Login Profile Creation: Rather than creating new IAM users or access keys, they quietly add login profiles to existing accounts, setting new passwords to take over those identities without generating the typical alerts associated with new user creation.
• GuardDuty Evasion: One of their initial moves is often to disable GuardDuty. While many security teams have detections for this, Scattered Spider goes further by deleting GuardDuty findings and dissociating from the master account, complicating re-enablement and forensic analysis.
• Logging Interruption: Attackers attempt to stop logging, believing it will halt the capture of events. However, the speakers clarify that this only prevents logs from being sent to their destination; the underlying API events are still captured and can be retrieved if monitoring the API directly.
• EC2 Instance Anomalies: They frequently create large, extensive EC2 instances, which can be an indicator of resource abuse or preparation for large-scale operations.

For cloud logs for defenders, the speakers emphasize foundational concepts:

• A log is a "fact" about "who did what and when," providing essential visibility.
• Enabling logging is paramount, as some Cloud Service Providers (CSPs) do not enable it by default for all services.
• Storing logs to a secondary, cheap location (e.g., S3 bucket, Azure Blob Storage) is crucial for long-term retention beyond CSP-defined limits (e.g., 30 or 90 days).
• Aggregating and correlating logs from various sources is necessary for comprehensive threat hunting.
• The inherent challenges of cloud logs include CSP-determined formats, potential delays in generation, and their often abstract nature compared to on-premise logs.

To address these challenges, Permiso Security developed Cloud Grappler, an open-source threat detection framework.

• Threat Actor Querying: Cloud Grappler contains over 140 predefined TTPs, not just for LUCRE3, but also for other groups like Go Evil and tools like Andro Ghost, including the latest for LLM hijacking. It scans cloud environments for indicators of these threat actors.
• Single Event Detection: It identifies specific events that, while not necessarily malicious in isolation, are favored by threat actors. An example given is get file download URLs from Cloud Shell, which could indicate exfiltration of sensitive data like secrets or password files.
• Multi-Cloud Support: Initially supporting AWS and Azure, Cloud Grappler has now integrated GCP, covering the three largest CSPs.
• Core Technology: Cloud Grappler is built upon Cloud Grab, another open-source tool by Chris Dorman, which focuses on graphing cloud storage.
• Configuration: Users define the scope selector, specifying AWS buckets and prefixes (recommended for performance with large datasets), Azure storage account names and containers, or GCP buckets.
• Custom Queries: Beyond the predefined TTPs, users can add their own queries, following a pattern that includes a name and a regular expression (regex) for searching.
• Report Generator: Upon completion, the tool outputs findings in JSON format, facilitating further investigation.

Demo / Proof of Concept

▶ Watch: Scattered Spider's consistent themes: targeted personas and TTPs (5:30)

Andi Ahmeti provided a brief but effective demonstration of Cloud Grappler in action, showcasing its capabilities across different cloud environments. The demo began by illustrating how Cloud Grappler could scan a specified GCP bucket. The command execution quickly completed, reporting three "hits" or detections, indicating the presence of TTPs within that environment. This was followed by a similar demonstration for an AWS bucket, which yielded four hits and completed with comparable speed, highlighting the tool's efficiency for scanning.

The demonstration then progressed to illustrate additional features. By adding the --permissible-intel flag, the output included a detailed description for each detected query, providing context about the identified TTP. For instance, a detection might show an event like get file download URLs, accompanied by its threat actor type, severity, and a short description. Furthermore, the --json-output flag was demonstrated, which directs Cloud Grappler to output every detected log in a structured JSON format. This is invaluable for security analysts who need to further investigate specific events, integrate findings into other security tools, or perform detailed forensic analysis.

Finally, the demo showed how Cloud Grappler organizes its findings. After a scan, the tool creates a reports folder. Inside this folder, the results are neatly categorized by Cloud Service Provider (CSP) (e.g., AWS, GCP), timestamp of the scan, the name of the bucket or container scanned, and the specific TTPs or reports found. This structured output ensures that security teams can easily navigate and review scan results, understand the context of the detections, and prioritize their response efforts based on the detailed information provided. The demo effectively conveyed Cloud Grappler's ease of use, speed, and the richness of its output for identifying sophisticated cloud threats.

Defensive Implications

▶ Watch: High-level overview of a modern cloud attack's typical flow (7:08)

Understanding Scattered Spider's TTPs is crucial for formulating robust defensive strategies. The insights provided by Ahmeti and Morina offer several key implications for cloud defenders:

1. Enhanced Identity and Access Management (IAM) and Authentication:

• MFA Everywhere, but with Caveats: While MFA is essential, defenders must recognize its limitations against social engineering tactics like SIM swapping or push-for-keep attacks. Implementing phishing-resistant MFA (e.g., FIDO2 hardware tokens) is critical, but even then, user education against bribery attempts is necessary.
• Strict Least Privilege: Regularly audit and enforce least privilege across all identities (human and non-human). Attackers target roles with excessive permissions (identity admins, sysadmins, security personnel). Removing unnecessary access, especially to applications not typically used by an employee, can significantly reduce the attack surface.
• Monitor MFA Registrations and Changes: Implement alerts for new MFA device registrations, changes in MFA methods (e.g., from hardware token to SMS), or password reset email changes. These are key persistence mechanisms for Scattered Spider.

1. Comprehensive Logging and Centralized Visibility:

• Enable All Logs: Ensure logging is enabled for all cloud services, IDPs, and SaaS applications. Do not rely on default settings, as some services may not log by default.
• Centralized Log Aggregation and Retention: Store logs in a secondary, immutable location with extended retention periods (beyond CSP defaults). This is vital for forensic analysis and long-term threat hunting, especially given Scattered Spider's persistence.
• Correlate Across Platforms: Aggregate and correlate logs from IDPs (Azure AD, Okta), SaaS applications (Confluence, Slack, GitHub), and IaaS platforms (AWS CloudTrail, Azure Monitor, GCP Cloud Logging) to gain a holistic view of user activity.

1. Behavioral Analytics and Anomaly Detection:

• IDP Anomaly Detection: Monitor for unusual login patterns: logins from new ASNs or residential proxies, rapid changes in device types (e.g., iPhone 15 to 11), or logins from locations inconsistent with the user's typical access patterns.
• SaaS Usage Baselines: Establish baselines for SaaS application usage. Alert on sudden, uncharacteristic activity, such as a long-time employee suddenly accessing GitHub or searching for sensitive terms like "AKIA" or "Shodan API" in wikis.
• Cloud Service Anomaly Detection: Monitor for:
• S3 Browser for IAM: Alert on any IAM operations (user creation, login profile updates, permission changes) performed via S3 Browser.
• SSM Scheduling: Detect unusual SSM commands or scripts scheduled for frequent execution (e.g., every 30 minutes).
• Cloud Shell Activity: Pay close attention to Cloud Shell usage, particularly for get secret value commands in loops or file uploads/downloads.
• Instance Profile Changes: Alert on modifications or replacements of EC2 instance profiles, especially those granting overly permissive roles.
• GuardDuty & Logging Status: Create high-priority alerts for any attempts to disable GuardDuty, delete findings, dissociate from master accounts, or stop logging to central destinations.

1. Proactive Threat Hunting with Tools like Cloud Grappler:

• Regular TTP Scanning: Integrate tools like Cloud Grappler into security operations to regularly scan cloud environments for known threat actor TTPs. This allows defenders to proactively identify compromises that might bypass traditional alerts.
• Custom Query Development: Leverage Cloud Grappler's ability to create custom queries to detect new or evolving TTPs specific to the organization's environment or emerging threats.

1. User Education and Awareness:

• Social Engineering Awareness: Continuously educate users, especially those in high-privilege roles, about social engineering tactics used to bypass MFA or gain credentials (e.g., SIM swapping, phishing, push notification fatigue, bribery attempts).
• Email Security: Emphasize the importance of reporting suspicious emails and be aware of automated email deletion rules that attackers might set up to hide their tracks.

By adopting these comprehensive defensive measures, organizations can significantly improve their ability to detect, respond to, and ultimately "grapple and strangle" sophisticated threat actors like Scattered Spider in the cloud.

Key Takeaways

• Scattered Spider (LUCRE3) is a highly persistent and financially motivated threat actor that constantly adapts its tactics, frequently re-engaging targets for multi-million dollar extortion.
• They primarily leverage legitimate cloud services and tools ("living off the land"), making traditional, malware-centric detection insufficient. Defense must shift to behavioral analytics and deep log analysis across IDP, SaaS, and IaaS.
• Targeted reconnaissance and persona emulation are critical initial steps for Scattered Spider, often involving researching identity admins, sysadmins, and even security personnel to gain initial access and establish persistence.
• Specific AWS TTPs include abusing S3 Browser for IAM actions, using SSM for persistent data gathering, extracting secrets via Cloud Shell, manipulating instance profiles, and attempting to disable GuardDuty or logging.
• Comprehensive log collection, aggregation, and correlation across all cloud providers (AWS, Azure, GCP), IDPs, and SaaS applications are paramount for visibility and detecting subtle anomalies indicative of compromise.
• Tools like Cloud Grappler empower defenders to proactively hunt for known threat actor TTPs across diverse cloud environments, providing critical insights and facilitating rapid detection through predefined and custom queries.

About the Speaker(s)

Andi Ahmeti and Abian Morina are Associate Threat Researchers at Permiso Security. Both are actively involved in the front lines of cloud security, focusing on investigating malicious activities, researching new detection techniques, and developing tools to strengthen cloud security postures.

Andi Ahmeti, hailing from Kosovo, has been working as an Associate Threat Researcher for over a year and a half. He is a co-author of Cloud Grappler, the open-source threat detection framework discussed in the talk, and also co-authored Cloud Console Photographer with his manager, Daniel Bohanan. His work involves actively "finding evil in the cloud" and contributing to the open-source security community.

Abian Morina recently completed his bachelor's studies and initially ventured into cybersecurity through practical experiences like hacking cameras and video games, which eventually led him to pursue it as a legitimate career path. In his role, he collaborates closely with Permiso's P.O. labs team, ensuring client infrastructure security by leveraging machine learning and extensive detection rules to protect both human and non-human identities across various cloud services.