Scattered Spider SaaS targeting (2024) (Campaign)

UNC3944 (Scattered Spider) is a financially motivated threat group abusing social engineering, identity tools (Okta, AD FS), and cloud/SaaS platforms to steal data for extortion. Active since 2022, the group expanded from credential harvesting and SIM swap fraud to persistent access via virtual machines, lateral movement through SaaS permissions, and large-scale data exfiltration using tools like Airbyte and Fivetran, targeting services including vCenter, CyberArk, Salesforce, Azure, CrowdStrike, AWS, and GCP.