Scattered Spider
The sentencing followed "only the second criminal prosecution of its kind in the UK under the Computer Misuse Act (CMA)."
“A Microsoft device identifier (a Global Device ID, or GDID, described below) associated with STOKES is linked to the .168 address”
First arrest came within days of the incident
This week on the Young and the Restless...
A range of ransomware groups have been seen spoofing IT support numbers or abusing default Teams credentials in social engineering attacks over the past 18 months.
The group "register their own MFA tokens [and] add a federated identity provider to the victim’s SSO tenant and activate automatic account linking..."