Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE8 IOCs
Scattered Spider: Social Engineering Meets Cloud Ransomware Tactics
Threat Actors
Malware Families
Diamond Model
Adversary(3)
Infrastructure(6)
Capability(6)
Victim
Indicators of Compromise
Indicators of Compromise8
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | twitter-okta.com exploitintel-blogmalware | High | 58 | Oct 9, 26 |
| CVE | CVE-2015-2291 exfiltrationexploitintel-blog | Medium | 54 | Oct 9, 26 |
| Domain | gucci-cdn.com exploitintel-blogmalware | High | 58 | Oct 9, 26 |
| IP | 99.25.84.9 botnetexploitintel-blog | High | 58 | Oct 9, 26 |
| Domain | victimname-cdn.com botnetexploitintel-blog | High | 58 | Oct 9, 26 |
| Domain | victimname-sso.com exploitintel-blogmalware | High | 58 | Oct 9, 26 |
| Domain | victimname-servicedesk.com exploitintel-blogmalware | High | 58 | Oct 9, 26 |
| CVE | CVE-2021-35464 exploitintel-blogmalware | Medium | 51 | Oct 9, 26 |
IOC Relationship Graph
IOC Relationship Graph8 total IOCs
DomainCVEIP