Scattered Spider Pivots to SaaS Application Attacks

UNC3944 (a.k.a. Scattered Spider) is a highly capable, English-speaking financially motivated adversary that has expanded from targeting on-premises and Microsoft cloud environments to compromising enterprise SaaS applications. Using sophisticated social-engineering (voice phishing, SIM-swapping) to obtain credentials and SSO access, the group conducts reconnaissance in SaaS apps, exfiltrates data using cloud sync tools to external S3 buckets, and establishes persistence by spinning up VMs (removing Defender telemetry and installing tools like Mimikatz, NGROK) — with known ransomware incidents affecting large organizations.