The value of a finished intelligence product is not measured by its length or technical depth — it is measured by whether it drives a better decision.
Flash Alert Template
FLASH ALERT — IMMEDIATE DISTRIBUTION
=====================================
Date/Time (UTC): 2024-09-15T14:30:00Z
Classification: TLP:AMBER — Authorized Recipients Only
Distribution: SOC Lead, IR Team, Network Security, CISO
Alert ID: CTI-2024-FA-0047
THREAT: Active exploitation of Ivanti Connect Secure VPN (CVE-2024-21887)
by multiple threat actors; CISA emergency directive issued
AFFECTED: Organizations running Ivanti Connect Secure or Policy Secure VPN
INDICATORS OF COMPROMISE:
Network:
- Unusual SOAP API requests to /api/v1/license/key-status (pre-auth RCE vector)
- Outbound connections from VPN appliance to external IPs on non-standard ports
- New administrative accounts created on VPN management interface
Files:
- Web shells in /data/runtime/tmp/tt/ on the VPN appliance filesystem
- Modification of /etc/passwd or /etc/shadow on the appliance
IMMEDIATE ACTIONS (complete within 4 hours):
☐ 1. Run CISA integrity checker tool against your Ivanti appliance
(tool: https://www.ivanti.com/blog/security-update)
☐ 2. Check VPN admin logs for new accounts created in past 30 days
☐ 3. Check VPN traffic logs for POST requests to /api/v1/* from external IPs
☐ 4. If exploitation is suspected: isolate appliance, contact IR team
☐ 5. Apply Ivanti patches (available: Dec 2023 version) — if not already patched
CONTEXT (read after actions):
Multiple threat actors including Chinese state-linked groups and criminal
ransomware operators are actively exploiting this vulnerability. CISA
confirmed federal agency compromise. Mass exploitation began 2024-01-11.
Full tactical threat brief will be distributed by EOD.
CONTACT: CTI Team — [Slack/Teams channel] | [On-call number]Tactical Threat Brief Template
# TACTICAL THREAT BRIEF
**Subject**: Scattered Spider — Social Engineering Campaigns Targeting Hospitality and Retail
**Date**: September 15, 2024 | **Classification**: TLP:AMBER
**Distribution**: SOC Lead, Detection Engineering, IR Team
**Author**: CTI Team | **Version**: 1.0
---
## BOTTOM LINE UP FRONT
Scattered Spider (UNC3944) is actively conducting social engineering campaigns
against hospitality, gaming, and retail organizations targeting their IT help
desks to bypass MFA and gain initial access to cloud environments. We assess
with HIGH confidence that this group represents an active threat to organizations
in our sector based on recent confirmed campaigns. Immediate recommendation: review
and harden IT help desk identity verification procedures.
---
## THREAT DESCRIPTION
Scattered Spider is a financially-motivated threat actor active since 2022,
primarily English-speaking (US/UK/Canada), known for sophisticated social
engineering. Recent campaign (August–September 2024) targeted MGM Resorts,
Caesars Entertainment, and others in hospitality/gaming using the same initial
access methodology.
## INITIAL ACCESS METHOD (T1566 — Phishing; T1534 — Internal Spearphishing)
1. Attacker calls IT help desk impersonating an employee
2. Claims to have lost their phone and cannot complete MFA
3. Social engineering convinces help desk to reset MFA via OTP sent to
attacker-controlled device
4. Attacker logs in with valid credentials + newly provisioned MFA
## TTPs OBSERVED IN CONFIRMED CAMPAIGNS
| Technique | ID | Notes |
|-----------|-----|-------|
| Phone-based social engineering | T1534 | Impersonation of employees |
| MFA bypass via IT help desk | T1556 | Help desk policy exploitation |
| Entra ID / Okta manipulation | T1556.006 | Adding attacker-controlled authenticator |
| BYOVD driver for EDR bypass | T1211 | Scattered Spider unique capability |
| Living off the land (LOLBins) | T1218 | Avoids malware detection |
| Data theft + double extortion | T1567 | Ransomware deployed or threatened |
## DETECTION OPPORTUNITIES
1. Help desk MFA reset events: alert on any MFA factor addition/reset not
initiated by the user themselves (Entra/Okta admin logs)
2. New MFA device additions from unrecognized device fingerprints
3. Entra ID Conditional Access bypass: monitor for legacy auth or
compliant device requirement failures followed by successful auth
## INDICATORS OF COMPROMISE
None publicly released for current campaigns (no infrastructure IOCs from MGM/Caesars)
Historical domains (low confidence, likely rotated):
→ [See MISP event CTI-2024-0234 for full indicator list]
## RECOMMENDED ACTIONS
P1 (This week):
☐ Review IT help desk identity verification procedure — require employee
callback on file + manager approval for any MFA reset
☐ Enable alerts on MFA factor additions in Entra/Okta admin logs
P2 (This quarter):
☐ Implement phishing-resistant MFA (FIDO2/hardware keys) for IT admins
☐ Tabletop exercise: simulate Scattered Spider help desk social engineering call
## INTELLIGENCE GAPS
- Current infrastructure (IPs/domains) not known — help desk-based initial
access leaves limited network indicators
- Group composition and location: suspected US/UK-based; exact structure unknown