Windows Device ID helped the FBI link an alleged Scattered Spider member to a retailer attack

Colleagues, I’d like to highlight a cybersecurity case.

I noticed a court filing in which a persistent Windows Device ID helped the FBI link an alleged Scattered Spider member to an attack on a jewelry retailer.

What happened:
• the attackers used the help desk to reset passwords and MFA;
• they used ngrok and Teleport for covert access;
• they exfiltrated at least 77 GB of data and demanded $8 million.

Why it matters: the weak point is not only the perimeter, but also support processes. Identity verification during resets, protection of privileged accounts, and phishing-resistant MFA are critical.

How do you assess the risk of such help desk attacks?

#cybersecurity #ransomware #incidentresponse #threatintelligence