Scattered Spider Abuses Cloud Management Agent (Campaign)
ID: d85a4d12-8f55-52ab-8ed9-520bdcf42675
STIX ID: report--d85a4d12-8f55-52ab-8ed9-520bdcf42675
Feed Name: Wiz Cloud Threat Landscape
Date Published: 2024-08-09
Date Updated: 2026-05-01
Author: [email protected] (Wiz Threat Research)
In May 2024 CrowdStrike observed the Scattered Spider group gain initial access via phishing-obtained credentials, authenticate to a cloud control plane, and abuse a cloud-hosted VM management agent to run commands, create a user account, and attempt to install remote access software (FleetDeck); the attackers conducted reconnaissance using ping, nltest, and wmic, and used a multi-domain approach across email, cloud management, and the VM to evade detection.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.