Cybersecurity Advisory on Scattered Spider Threat Actors

This document is a joint Cybersecurity Advisory (CSA) released by the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) regarding the activities of the Scattered Spider threat actors. The advisory details the tactics, techniques, and procedures (TTPs) employed by this cybercriminal group, which primarily targets large companies and their IT help desks. Scattered Spider is known for engaging in data theft and extortion, often using BlackCat/ALPHV ransomware. The advisory encourages critical infrastructure organizations to implement specific mitigations to reduce the risk of cyberattacks. It outlines various methods used by Scattered Spider, including social engineering techniques like phishing and SIM swapping, as well as the use of legitimate remote access tools and malware. The document also references the MITRE ATT&CK framework to categorize the threat actors' activities and provides technical details on the tools and methods utilized by Scattered Spider.