Scattered Spider Attack Analysis

ReliaQuest investigated a multi-day intrusion attributed to the Scattered Spider (ALPHV/BlackCat affiliate) in which attackers used social engineering to reset admin credentials, performed MFA-fatigue and Okta IdP manipulation to gain privileged SSO access, conducted SharePoint file discovery to inform rapid lateral movement into on-premises Citrix VDI sessions, downloaded legitimate tools (e.g., ADExplorer), accessed LastPass vaults, exfiltrated data to transfer.sh (IP 144.76.136.153) and deployed persistence and encryption tools; the report documents IoCs and TTPs and recommends mitigations such as MFA fatigue rules, stricter help-desk verification, privileged identity management, and centralized logging.