Socially Savvy Scattered Spider Traps Cloud Admins in Web

Scattered Spider (Octo Tempest) has executed targeted, highly convincing phone‑based social‑engineering attacks (smishing/vishing) and phishing that impersonate employees and SSO portals to steal high‑privileged cloud credentials, manipulate MFA, and gain persistent access — leveraging techniques such as SIM swaps, purchased credentials, and abuse of cloud‑native tools (e.g., Azure Special Administration Console, Data Factory) to move into cloud environments and deploy ransomware; EclecticIQ’s analysis (2023–Q2 2024) details these TTPs, impacted SaaS and cloud services, and recommends defensive measures including secure authentication, monitoring, hypervisor/cloud resource security, and domain/typosquatting protections.