Living off the (land)cloud: Scattered Spider and the cloud control plane

Living off the (land)cloud: Scattered Spider and the cloud control plane

Speakers: Shivakumar Buruganahalli, Senior Director of Customer Engineering and Disruption Strategy, Aalia Networks

Conference: BSides NYC

YouTube: https://www.youtube.com/watch?v=Zdo5hMNTcVA

Overview

In an era of rapidly evolving cyber threats, the Scattered Spider group, also known as UNC3944 or Scatterswine, has emerged as a particularly insidious adversary. This talk by Shivakumar Buruganahalli, Senior Director at Aalia Networks, provides a comprehensive deep dive into their sophisticated attack methodologies, focusing on their unique ability to weaponize identity and target the highly critical cloud control plane. Buruganahalli meticulously deconstructs Scattered Spider's tactics, techniques, and procedures (TTPs), illustrating how they bypass conventional security measures by "living off the land" and "living off the cloud," leveraging legitimate tools and social engineering to achieve rapid compromise.

The presentation highlights the critical shift in the threat landscape where the traditional perimeter has dissolved, making identity the new battleground. Scattered Spider's prowess in social engineering allows them to gain initial access without deploying specialized malware or engaging in phishing campaigns, rendering many established detection mechanisms ineffective. The talk culminates in a proposed solution centered around deception technology, specifically honey accounts and honey tokens, designed to provide early, high-fidelity detection against these fast-moving, identity-centric threats, thereby augmenting existing security infrastructures and inducing confusion among attackers. This analysis is crucial for security practitioners seeking to understand and defend against advanced adversaries that exploit the very fabric of modern enterprise and cloud operations.

Background

▶ Watch: Introduction and talk agenda (0:00)

Scattered Spider, also known by monikers such as UNC3944 and Scatterswine, is a highly adaptive and dangerous threat group. Originating from a background of online gaming (Roblox, Minecraft) and early crypto-stealing activities, these individuals quickly recognized the potential of identity exploitation beyond digital currencies. By 2022, they had significantly escalated their operations, shifting their focus to enterprise environments and forming an affiliation with the notorious Alpha Blacket ransomware-as-a-service group. Their reach is extensive, impacting a broad spectrum of verticals including insurance, hospitality, retail, casinos, finance, and airlines.

Their attack cycle, initially honed for on-premise environments, is characterized by a masterly command of social engineering and a complete disregard for traditional malware. The process typically unfolds as follows:

1. Initial Access: Attackers impersonate a low-privileged employee, often gathering information from public sources like LinkedIn. They then call the help desk, convincing support staff to perform a password reset for the target account. This often involves sophisticated social engineering techniques, SIM swapping, and voice phishing to bypass Multi-Factor Authentication (MFA). Once the password is reset, the attackers gain insider access.
2. Reconnaissance and Lateral Movement: Inside the network, they conduct extensive reconnaissance to map the environment, identify critical "crown jewels," and locate sensitive data stored in platforms like Jira, Confluence, wikis, SharePoint, and various document repositories.
3. Privilege Escalation: Leveraging the gathered intelligence, they identify high-value targets, typically IT administrators. They repeat the social engineering tactic, impersonating these administrators to gain a privileged password reset, thereby achieving privileged credential access.
4. Targeting vCenter: With privileged access, they target the vCenter, which serves as the control plane for virtualized environments. Gaining access to vCenter allows them to manage all ESXi hosts. They proceed to enable SSH access on ESXi hosts (which security best practices typically disable) and reset passwords, effectively taking control of the entire virtual infrastructure.
5. Domain Controller Compromise: They then target Active Directory Domain Controllers (DCs), which are often hosted on ESXi virtual machines. They power down a DC VM, detach its disk, and attach it to another VM. From this new VM, they copy the NTDS.dit file, which contains all user credentials, Kerberos tickets, and other critical identity information.
6. Data Exfiltration: All harvested data, including the NTDS.dit file, is then exfiltrated from the compromised network.
7. Ransomware Deployment: In the final stage, they deploy ransomware specifically designed for ESXi hosts, encrypting all virtual machines, datastores, and shared resources, leading to a complete operational shutdown of the enterprise.

What makes Scattered Spider particularly unique is their avoidance of specialized malware or phishing campaigns for initial access. Their attacks are identity-centric, weaponizing legitimate credentials and processes. The entire attack cycle, from initial penetration to ransomware deployment, can occur within a mere few hours, demonstrating their speed and automation. They adapt their TTPs for both on-premise and cloud environments, harvesting extensive data from platforms like Office 365, Teams, SharePoint, and Exchange, and even engaging in code stealing from CI/CD pipelines.

The speaker emphasizes the rise of the "cloud-conscious adversary," groups like Scattered Spider that are intimately familiar with cloud platforms such as AWS, Google Cloud, and Azure. Their cloud attack cycle mirrors their on-premise approach: initial social engineering leads to Azure admin access, followed by reconnaissance within the Azure environment (identifying EC2 instances, containers, data stores using Azure CLI), and ultimately gaining privileged access. They possess distinct automated scripts for deploying ransomware in ESXi hosts versus Azure environments.

The challenges in detecting Scattered Spider attacks are substantial:

• Absence of Malware/Phishing: No traditional indicators for endpoint or email security.
• Identity-Centric: Differentiating legitimate user actions from those of a compromised identity is extremely difficult.
• Living off the Land/Cloud: They utilize native tools and services (e.g., Azure Data Factory for exfiltration), blending in with normal operations.
• Speed: The rapid execution window (hours) often leaves security teams with little time to react.
• MITRE ATT&CK Alignment: Their activities span numerous MITRE ATT&CK tactics, including Initial Access, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Data Collection, and Exfiltration.

The cloud environment presents additional complexities for detection:

• Dynamic and Ephemeral Workloads: Resources are constantly provisioned and de-provisioned, making static monitoring challenging.
• Workload Mobility: Resources can shift between on-prem and cloud environments.
• Multiple Identity Paths: Complex identity and access management (IAM) structures.
• Volume and Variety of Logs: Overwhelming amounts of log data from diverse sources and services.

Crucially, the talk differentiates between the data plane and the control plane in cloud environments. The data plane handles workloads (VMs, containers, databases, storage), and while its compromise can be severe, its impact is often confined to a specific service or customer. In contrast, the control plane is the core layer that manages all cloud resources, including governance and orchestration. A compromise of the control plane grants attackers the "keys to the kingdom," allowing them to create new accounts, spin up costly VMs (e.g., for crypto harvesting), exfiltrate massive volumes of data, encrypt everything, and crucially, disable monitoring logs and delete their traces. This level of access bypasses Endpoint Detection and Response (EDR) solutions and can impact multiple customers in a shared cloud provider environment (e.g., Salesforce, Snowflake, Databricks).

Key Findings

▶ Watch: Initial access: Social engineering help desk (4:00)

The core findings presented in this talk illuminate the evolving nature of advanced persistent threats and the critical vulnerabilities in modern enterprise and cloud security architectures:

• Weaponized Identity as the Primary Attack Vector: Scattered Spider's success demonstrates a paradigm shift where identity has replaced traditional malware or network-based exploits as the primary means of initial access and lateral movement. Their mastery of social engineering allows them to bypass robust MFA and gain legitimate credentials, rendering many perimeter-focused and signature-based defenses obsolete.
• The Cloud Control Plane: The Ultimate Target: The talk definitively establishes the cloud control plane as the most critical and high-impact target for sophisticated adversaries. Compromise of this layer grants attackers unparalleled power, enabling them to manage, create, and destroy all cloud resources, effectively giving them complete control over an organization's entire cloud footprint, with potential implications for multi-tenant cloud providers and their customers.
• Inadequacy of Traditional Detection Methods: Attacks that "live off the land" and "live off the cloud," utilizing native tools and legitimate user behaviors, are inherently difficult for traditional security solutions like EDRs, SIEMs, and intrusion prevention systems to detect. The speed of these attacks (within hours) further exacerbates this challenge, leaving minimal time for incident response.
• Deception Technology as a High-Fidelity Countermeasure: The talk proposes and demonstrates that deception technology, specifically the strategic deployment of honey accounts and honey tokens, offers a highly effective, low-cost, and high-fidelity solution for early detection of these advanced, identity-centric attacks. By enticing attackers with fake, yet realistic, credentials and assets, deception forces them to reveal their presence without requiring complex log correlation or signature matching.
• Inducing Attacker Confusion and Delay: A significant contribution of deception is its ability to introduce confusion and hysteria into the attacker's operational cycle. By poisoning reconnaissance data and creating an environment where attackers cannot trust the validity of harvested credentials, deception buys critical time for defenders and disrupts the attacker's efficiency.

Technical Deep Dive

▶ Watch: Privilege escalation: Targeting administrators for access (6:00)

Scattered Spider's technical prowess lies not in developing zero-day exploits, but in their sophisticated orchestration of common techniques, weaponizing identity and native cloud features. Their on-premise attack flow, as detailed, leverages social engineering to acquire legitimate credentials, specifically targeting password resets to bypass MFA. Once inside, they conduct thorough reconnaissance, often identifying sensitive data in collaboration platforms and internal documentation systems. Privilege escalation is achieved by repeating the social engineering process for higher-privileged accounts, such as IT administrators.

A critical phase involves targeting vCenter, the management interface for VMware environments. Gaining access allows them to modify ESXi host configurations, such as enabling SSH, which is typically disabled for security. This control over the virtualization layer is then leveraged to compromise Active Directory Domain Controllers (DCs). The technique of powering down a DC VM, detaching its virtual disk, and attaching it to another attacker-controlled VM to extract the NTDS.dit file is a well-known, yet highly effective, method for dumping credentials and Kerberos tickets. This file contains hashed passwords for all domain users, providing a treasure trove for offline cracking or pass-the-hash attacks.

In the cloud, Scattered Spider adapts these TTPs. Initial access often leads to Azure admin access. Their reconnaissance within Azure environments is conducted using legitimate tools like the Azure CLI, making their activity indistinguishable from a legitimate DevOps engineer. They identify various cloud assets like EC2 instances, containers, and data stores. Exfiltration of data is performed using native cloud services such as Azure Data Factory, further blending their malicious activities with normal cloud operations. They also prioritize disabling monitoring logs and deleting traces to evade detection.

The proposed defensive strategy centers on deception technology, specifically honey accounts and honey tokens.

• Honey Accounts: These are deceptive user accounts, IAM roles, services, or API keys created within the cloud environment. They are designed to look realistic, juicy, and active to entice attackers. For example, a honey account might be named "prod_admin_backup" or "devops_root_access," making it highly appealing. The key is that these accounts are not used by any legitimate user or service, so any interaction with them immediately signals malicious activity.
• Honey Tokens: These are fake secrets, credentials, or keys that are associated with honey accounts or designed to trigger alerts independently. Examples include:
• Fake SSH keys: Placed in publicly exposed S3 buckets or within instance metadata.
• Deceptive Kerberos tickets: Embedded in file systems.
• Fake API keys: For AWS, Azure, or other cloud services.
• Dummy session cookies: Mimicking active user sessions.
• Fabricated code signing certificates: To lure attackers interested in supply chain compromise.

The strategic embedding and distribution of these honey tokens are paramount. They are sprinkled across various cloud assets and common attacker targets:

• Compute Instances: Within instance metadata, bash history, or environment variables on EC2 instances or containers.
• Secret Managers/Vaults: Creating fake secrets within services like AWS Secrets Manager or HashiCorp Vault.
• Kubernetes Clusters: Injecting fake credentials into Kubernetes secrets or configuration maps.
• CI/CD Pipelines: Committing honey tokens directly into code repositories or configuration files (e.g., a README.md file with fake database credentials).
• Publicly Exposed Buckets: Placing fake SSH keys or other credentials in misconfigured storage buckets.

When an attacker, during their reconnaissance or privilege escalation attempts, interacts with any of these deceptive assets (e.g., attempts to use a fake SSH key, queries a honey account, or tries to assume a honey role), a high-fidelity alert is immediately triggered. Unlike traditional security solutions that rely on complex log correlation or anomaly detection, a honey token interaction is a definitive indicator of compromise, requiring no further processing or analysis to confirm malicious intent. This early detection mechanism allows security teams to respond rapidly, either by blocking the attacker, initiating a full incident response, or even actively monitoring the attacker's subsequent actions within a controlled environment (a "honey net") to gather intelligence on new TTPs.

Demo / Proof of Concept

▶ Watch: Data exfiltration and ransomware deployment (7:45)

The talk included a concise demo illustrating the effectiveness of honey accounts in detecting privilege escalation attempts within a cloud environment. The scenario unfolded as follows:

1. Compromise of a Low-Privileged User: The demonstration began with an attacker successfully compromising a low-privileged user account, mimicking Scattered Spider's initial access phase.
2. IAM Role Enumeration: The attacker, now operating with the compromised user's identity, proceeded to enumerate IAM (Identity and Access Management) roles within the cloud environment. Their objective was to identify roles that offered significant privileges, such as an "RDS admin role," which would grant extensive control over database services.
3. Policy Reconnaissance: Upon identifying a potentially high-value IAM role, the attacker performed a deeper reconnaissance to retrieve the policy associated with that specific IAM role. This step is crucial for attackers to understand the exact permissions granted by the role and to confirm if it allows for privilege escalation. In the demo, the attacker confirmed that the policy indeed permitted broad actions on RDS resources.
4. Attempted Privilege Escalation via Assumed Role: The critical moment occurred when the attacker attempted to leverage an assume-role operation to gain the elevated permissions of the identified privileged role. However, the assume-role operation was directed towards a deceptive honey account that had been strategically deployed by the defenders.
5. Alert Trigger and Denial: The moment the attacker attempted to assume-role with the deceptive honey account, the system immediately denied the request and simultaneously triggered a high-fidelity alert on the security console. This effectively demonstrated that the attacker had "stepped on a mine," revealing their presence and malicious intent at the point of attempted privilege escalation.

This demo effectively highlighted two potential points of early detection: either when the attacker initially picks up a deceptive user account, or, as shown, when they attempt to escalate privileges using a deceptive assumed role. The immediate alert provides security teams with actionable intelligence, enabling them to block the attack, initiate response protocols, or conduct further threat hunting based on the unique signature of the triggered event.

Defensive Implications

▶ Watch: Scattered Spider's unique social engineering approach (8:30)

The detailed analysis of Scattered Spider's TTPs and the proposed deception-based solution offer several critical defensive implications for organizations aiming to bolster their cybersecurity posture:

1. Prioritize Identity Security and Deception: Given that identity is the new perimeter and the primary attack vector for groups like Scattered Spider, organizations must elevate identity security as a top priority. This includes robust MFA, strong password policies, and continuous monitoring of identity-related activities. Crucially, deception technology (honey accounts, honey tokens) must be integrated into the identity security strategy to detect when legitimate credentials are being misused or when attackers are attempting to harvest deceptive ones.
2. Assume Breach Mentality: The speed and stealth of Scattered Spider dictate an "assume breach" mentality. Defenders should operate under the assumption that an attacker could already be inside the network or cloud environment. This shifts focus from purely preventative measures to robust, early detection and rapid response capabilities, which deception technology uniquely provides.
3. Strategic Deployment of Deceptive Assets: Implementing deception is not merely about scattering fake credentials. It requires a strategic, attacker-centric mindset. Defenders must identify their organization's "crown jewels," understand typical attacker reconnaissance paths, and then "poison" these pathways with enticing, realistic, and strategically placed honey tokens and accounts. This includes embedding them in instance metadata, bash histories, CI/CD pipelines, secret managers, and even public cloud storage.
4. Focus on High-Fidelity Alerts: Traditional security operations often suffer from alert fatigue due to low-fidelity alerts requiring extensive correlation. Deception technology offers high-fidelity alerts that are definitive indicators of malicious activity. Organizations should leverage these alerts to reduce noise, prioritize investigations, and enable faster, more confident responses.
5. Induce Attacker Confusion and Buy Time: Deception's ability to introduce confusion and hysteria for attackers is a powerful defensive advantage. By presenting inconsistent data, fake project details, or untrustworthy credentials, organizations can significantly delay attackers, forcing them to spend more time validating information. This "buying time" is invaluable for defenders to detect, analyze, and neutralize the threat.
6. Augment Existing Security Controls: Deception is not a replacement for existing security infrastructure (EDRs, SIEMs, firewalls, IPS). Instead, it acts as a powerful augmentation, filling critical detection gaps against identity-centric, living-off-the-land/cloud attacks that often bypass traditional controls. It provides a unique telemetry stream that complements other security data.
7. Enable Proactive Threat Hunting: Alerts generated by honey tokens serve as excellent starting points for proactive threat hunting. When a deceptive asset is touched, security teams can use this specific event to retrospectively analyze logs, identify similar activities, and search for other potential compromises or dormant threats within the enterprise.
8. Educate and Train Staff: Social engineering remains a core component of Scattered Spider's success. Continuous training and awareness programs for all employees, especially help desk and IT staff, on identifying and resisting social engineering tactics are critical. Simulating social engineering attacks can also help build resilience.
9. Secure the Cloud Control Plane: Given the immense impact of a cloud control plane compromise, organizations must implement the strongest possible security controls around their cloud management interfaces. This includes strict IAM policies (least privilege), robust auditing, continuous monitoring of control plane activities, and the deployment of honey accounts/tokens specifically within these critical layers.

Key Takeaways

• Identity is the New Perimeter: Scattered Spider's success demonstrates that weaponized identity and sophisticated social engineering are now primary attack vectors, bypassing traditional malware and network-focused defenses.
• Cloud Control Plane is the Ultimate Target: Compromising the cloud control plane grants attackers "keys to the kingdom," enabling widespread impact, resource manipulation, and multi-customer compromise, far exceeding the damage of data plane breaches.
• Traditional Defenses Are Insufficient: Attacks "living off the land/cloud" using native tools and legitimate credentials are hard to detect with conventional EDRs or signature-based systems, especially given their rapid execution time.
• Deception Technology Provides High-Fidelity Detection: Honey accounts and honey tokens offer a potent, cost-effective solution for early, unambiguous detection of advanced adversaries by enticing them to interact with deceptive assets.
• Strategic Deception Disrupts Attackers: Carefully placed deceptive assets confuse attackers, force them to waste time validating information, and induce "hysteria," significantly slowing down their operations and buying critical time for defenders.
• Deception Augments Layered Security: Rather than replacing existing tools, deception technology complements and enhances current security infrastructures by providing unique, high-value threat intelligence and closing critical detection gaps.

About the Speaker(s)

Shivakumar Buruganahalli is the Senior Director of Customer Engineering and Disruption Strategy at Aalia Networks. With extensive experience in the cybersecurity space, particularly in the domain of deception technology, Buruganahalli brings a deep understanding of evolving threat landscapes and innovative defense strategies. His work focuses on developing and implementing solutions that effectively counter advanced persistent threats by leveraging proactive and intelligent security measures.