Spider shifts focus to SaaS app assaults in cybersecurity battle

TLDR:

• Threat actor UNC3944, also known as Scattered Spider, has shifted focus to targeting software-as-a-service (SaaS) application environments.
• The group has been observed using sophisticated social engineering tactics, including credential phishing and SIM-swapping, to access enterprise SaaS accounts.

Scattered Spider Pivots to SaaS Application Attacks

The recent attacks on customer accounts hosted on the Snowflake data warehousing platform may indicate a broader trend of threat actors targeting SaaS application environments. An English-speaking threat actor, UNC3944, previously known as Scattered Spider, has expanded its focus from Microsoft cloud environments and on-premises infrastructure to data in enterprise SaaS applications. The group has been involved in high-profile attacks against companies like MGM Resorts and Caesars Entertainment, employing tactics such as SIM-swapping and sophisticated credential phishing to gain access to accounts.

UNC3944 has recently been observed pivoting into client SaaS applications, using stolen credentials to access systems protected by single sign-on providers like Okta. The threat actor has conducted reconnaissance activities and stolen data from applications like vCenter, CyberArk, Salesforce, Azure, and more, transferring this data to cloud storage using synchronization utilities.

One of the group’s primary methods of acquiring credentials is through phishing and social engineering tactics. UNC3944 actors have been known to make voice calls to help desk staff, possessing detailed personal information about victims to pass authentication checks. The group has also created new virtual machines in victim environments for persistence, abusing administrative permissions tied through SSO applications.

Mandiant’s recommendations for organizations targeted by UNC3944 include using host-based certificates and MFA for VPN access, monitoring SaaS applications closely, and creating strict conditional access policies. The threat actor’s ability to leverage VMs for persistence and bypass endpoint monitoring highlights the need for enhanced security measures in cloud environments.