Scattered Spider: notifications until approval
According to MITRE ATT&CK, during campaign C0027 Scattered Spider kept sending multi-factor authentication messages until the victim accepted. MITRE ATT&CK
Methods of accessing an account protected by multi-factor authentication without passing the second factor, or by tricking the user.
According to CISA, some forms of multi-factor authentication are vulnerable to phishing, push bombing, SS7 vulnerabilities and SIM swap attacks; phishing-resistant methods are the most secure form. CISA
With infostealers, the most common route is never triggering verification at all: a stolen session cookie was created after sign-in, so it carries a session that has already passed the second factor. Google Chromium
The attacker repeatedly attempts to sign in, flooding the user with approval notifications until the user accepts. MITRE ATT&CK
One-time codes or hardware token input are captured through keylogging or interception. MITRE ATT&CK
The session cookie created after sign-in is used; verification is never requested. MITRE ATT&CK
According to MITRE ATT&CK, during campaign C0027 Scattered Spider kept sending multi-factor authentication messages until the victim accepted. MITRE ATT&CK
According to Mandiant, multi-factor authentication was not enabled on the compromised Snowflake accounts; the stolen password was enough on its own. Google Cloud (Mandiant)
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy