Cloud Warfare: Grappling and Strangling Scattered Spider
Andi Ahmeti, Abian Morina
BSides NYC 2024 · Day 1 · Tech - Other
In the dynamic landscape of cloud security, threat actors continually evolve their tactics, techniques, and procedures (TTPs) to bypass traditional defenses. The talk "Cloud Warfare: Grappling and Strangling Scattered Spider" by Andi Ahmeti and Abian Morina, Associate Threat Researchers at Permiso Security, delves into the sophisticated operations of a prominent financially motivated threat actor group, known by various monikers including **Scattered Spider**, **Octopus**, and **LUCRE3** (Permiso's internal designation). This presentation offers a comprehensive analysis of their modern cloud attack methodologies, with a particular focus on their activities within Amazon Web Services (AWS) environments.
AI review
Competent threat-intel briefing on Scattered Spider's cloud TTPs from researchers who clearly have first-hand detection data. The specific AWS abuse patterns and the Cloud Grappler tooling give defenders something concrete to work with, but the overall picture stays at the survey level — knowledgeable practitioners will recognize most of this terrain already.