Living off the (land)cloud: Scattered Spider and the cloud control plane
Shivakumar Buruganahalli
BSides NYC 2025 (0x05) · Day 1 · Tech - Other
In an era of rapidly evolving cyber threats, the Scattered Spider group, also known as UNC3944 or Scatterswine, has emerged as a particularly insidious adversary. This talk by Shivakumar Buruganahalli, Senior Director at Aalia Networks, provides a comprehensive deep dive into their sophisticated attack methodologies, focusing on their unique ability to weaponize identity and target the highly critical cloud control plane. Buruganahalli meticulously deconstructs Scattered Spider's tactics, techniques, and procedures (TTPs), illustrating how they bypass conventional security measures by "living off the land" and "living off the cloud," leveraging legitimate tools and social engineering to achieve rapid compromise.
AI review
A competent threat briefing on Scattered Spider that reads more like a vendor pitch for Aalia Networks' deception product than independent research. The TTP walkthrough is accurate but assembled entirely from public reporting, and the deception technology pitch is generic — nothing here would surprise anyone who's read the Mandiant or CrowdStrike write-ups on UNC3944.