Rapid7 Labs published a comprehensive TTP analysis on Rapid7 Labs of Scattered Spider (UNC3944, Scatter Swine, Muddled Libra), a financially motivated cybercriminal group active since May 2022. The group has escalated from telecommunications and tech-sector targeting to high-profile 2025 attacks on UK retailers, airlines, and financial institutions — including the 2023 MGM Resorts breach (est. $100M+ in losses, ~6 TB stolen). Scattered Spider combines expert social engineering with cloud-fluent lateral movement, legitimate tool abuse, and BYOVD driver attacks, increasingly partnering with ransomware groups including ALPHV/BlackCat and DragonForce.
Initial Access: Help Desk Impersonation, SIM Swapping, MFA Push Bombing, and ForgeRock RCE
Scattered Spider's primary initial access vector is help desk social engineering: attackers call IT support armed with LinkedIn-sourced employee details, impersonate the target, and convince help desk staff to reset passwords and MFA devices — granting elevated access without traditional privilege escalation. Additional techniques include phishing and vishing for credentials/OTPs via fake login pages, MFA push bombing (repeated prompts until a fatigued user accepts), SIM swapping to intercept SMS-based MFA codes, and exploitation of CVE-2021-35464 (ForgeRock AM RCE) in AWS-hosted identity services. The group also abused CVE-2015-2291 (Intel driver kernel mode code execution) for privilege escalation.
Novel C2 Persistence: Teleport Agent on AWS EC2 and AWS Session Manager Abuse
A previously undocumented Scattered Spider persistence mechanism observed by Rapid7 is the deployment of Teleport — a legitimate open-source infrastructure access platform — on compromised Amazon EC2 instances. After obtaining admin-level cloud access, the attacker installed Teleport agents to establish a persistent remote shell C2 channel that survives credential rotation or VPN revocation. Cloud lateral movement techniques include systematic EC2 instance enumeration, IAM instance profile queries, and AWS Session Manager/EC2 Serial Console abuse (T1526/T1563.002) — moving within cloud environments without deploying custom malware. On-premises, the group uses RDP, SMB/PsExec, and credential dumping via Mimikatz for lateral movement and privilege escalation.
STONESTOP/POORTRY BYOVD: Microsoft-Signed Driver Kills EDR Before Ransomware Deployment
Scattered Spider's most advanced defense evasion is the BYOVD toolkit STONESTOP (userland loader) and POORTRY (malicious Microsoft-signed kernel driver): STONESTOP installs POORTRY, which leverages driver signature enforcement bypass to terminate endpoint protection agents, antivirus processes, and EDR services at the kernel level — creating a detection-free window for data exfiltration or ransomware deployment. Additional persistence mechanisms observed include TeamViewer, AnyDesk, ScreenConnect, Splashtop, Ngrok, FleetDeck, Windows Scheduled Tasks (T1053), and new/stolen account creation (T1078). The group primarily uses legitimate administrative tools rather than custom malware — reducing detection risk from signature-based controls. Recent ransomware partnerships include ALPHV/BlackCat and DragonForce (UK retail attacks, 2025), with double extortion (exfiltrate-then-encrypt) as the consistent end-game.