Caught on Day 1: Scattered Spider Members Fold in TfL Case
Just saw the breaking news regarding the Transport for London (TfL) breach. Two key Scattered Spider actors pleaded guilty on the very first day of a scheduled six-week trial. Given the sophistication usually attributed to this group (aka 0ktapus), folding that fast suggests the prosecution likely had them dead-to-rights on forensic evidence or logs tying them directly to the August 2024 chaos.
We all know Scattered Spider specializes in social engineering and MFA bypass rather than traditional exploitation. The TfL attack caused significant disruption, not by exploiting a CVE in the transport systems directly, but by compromising the user identity layer—likely via targeted phishing or SIM swapping to bypass Okta/M365 controls.
For those of us on the defensive side, standard phishing simulations aren't cutting it anymore. We need to detect the behavioral patterns of MFA fatigue. If you are using Microsoft Sentinel, I recommend hunting for the "spam until they click" pattern with this KQL:
SigninLogs
| where ConditionalAccessStatus == "success"
| project UserPrincipalName, AppId, SuccessTime=TimeGenerated
| join kind=inner (
SigninLogs
| where ResultDescription has "MFA"
| where Status != "0"
| summarize FailedCount=count(), MaxFailTime=max(TimeGenerated) by UserPrincipalName, AppId
) on UserPrincipalName, AppId
| where SuccessTime between(MaxFailTime - 10m .. MaxFailTime + 2m)
| where FailedCount >= 5
| project UserPrincipalName, AppId, FailedCount
The TfL attack was a wake-up call for identity-centric security. With these guys pleading out, do you think we'll see a lull in their affiliate operations, or is the Scattered Spider brand too big to fail now?
It’s rare to see them fold that quickly unless the digital footprint was undeniable. We’ve seen a massive uptick in 'MFA fatigue' attempts in our environment recently. One additional check we run is looking for new device enrollment immediately following a batch of failures, which is their classic move.
Get-MsolDevice -RegisteredOwner UPN | Where-Object {$_.ApproximateLastLogonTimestamp -gt (Get-Date).AddHours(-2)}
If you see a device pop up right after a failed login storm, lock the account immediately.
This plea might be tactical for them, but I doubt it stops the affiliates. The 'brand' of Scattered Spider has proven too profitable in the initial access broker market. Regarding detection, we've had success moving strictly to FIDO2 keys for admins; it completely negates the push-spam vector they rely on. Until organizations enforce phishing-resistant MFA, these TTPs will remain effective regardless of who gets arrested.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access