Analytics Story: Scattered Lapsus$ Hunters

Updated Date: 2026-05-13 ID: be9e9520-48eb-4af2-8ff7-dd2dee2f5705 Author: Michael Haag, Splunk Product: Splunk Enterprise Security

Description

Scattered Lapsus$ Hunters is a collaboration of three sophisticated threat actor groups (Scattered Spider, Lapsus$, and Shiny Hunters) known for devastating supply chain attacks, advanced social engineering, MFA bypass techniques, and credential theft. The group gained notoriety following their September 2025 attack on Jaguar Land Rover, causing three weeks of production shutdown and £50M+ weekly losses.

Why it matters

Scattered Lapsus$ Hunters represents a dangerous collaboration between Scattered Spider (UNC3944), Lapsus$, and Shiny Hunters - three threat actor groups that combine sophisticated social engineering expertise with advanced technical capabilities. Their September 2025 cyberattack on Jaguar Land Rover demonstrated the catastrophic potential of targeting critical supply chain infrastructure, resulting in a three-week production shutdown, tens of millions in weekly losses, and thousands of jobs at risk across the automotive supply chain. The group's attack methodology begins with sophisticated initial access through voice phishing (vishing), SMS phishing (smishing), and SIM swapping to compromise credentials and bypass multi-factor authentication. They employ advanced MFA bypass techniques including MFA fatigue attacks through repeated push notifications, SIM swapping to intercept SMS codes, and adversary-in-the-middle attacks on authentication flows. Once inside a network, they leverage legitimate remote management tools (AnyDesk, TeamViewer, ScreenConnect) to maintain persistence and evade detection, following a living-off-the-land approach that minimizes custom malware. For credential access, the group employs tools like Mimikatz for credential dumping, targets LSASS memory, extracts browser-stored credentials, and steals OAuth tokens and session cookies. They excel at lateral movement using RDP, Pass-the-Hash and Pass-the-Ticket techniques, and internal spearphishing. The group demonstrates deep understanding of cloud environments, targeting Azure AD, AWS, GCP, and O365 with techniques to disable MFA, create privileged accounts, assign administrative roles to service principals, and modify authentication policies. Data exfiltration occurs through cloud storage services (MEGA, Google Drive), file sharing platforms, and custom exfiltration channels. The impact phase includes stopping critical services, deploying ransomware, system shutdowns to maximize disruption, and data destruction. Previous notable attacks attributed to the constituent groups include Lapsus$ breaches of Microsoft, Nvidia, Okta, Samsung, and Ubisoft (2022), and Scattered Spider attacks on MGM Resorts and Caesars Entertainment (2023). The group targets telecommunications, retail, technology, manufacturing, and critical infrastructure sectors. Organizations should implement phishing-resistant MFA (FIDO2/WebAuthn), monitor RMM tool deployment, enable comprehensive logging, deploy EDR solutions, train employees on advanced social engineering tactics, segment critical production systems, and maintain offline backups of critical data. The detections in this analytic story cover the full attack lifecycle including MFA manipulation, unauthorized remote access software, credential theft, session hijacking, privilege escalation, defense evasion, data exfiltration, and production system disruption.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Ivanti VTM New Account Creation	Exploit Public-Facing Application	TTP
Internal Horizontal Port Scan	Network Service Discovery	TTP
ASL AWS Create Policy Version to allow all resources	Cloud Accounts	TTP
AWS Credential Access RDS Password reset	Brute Force, Cloud Accounts	TTP
Okta MFA Exhaustion Hunt	Brute Force	Hunting
Okta New Device Enrolled on Account	Device Registration	TTP
Detect Remote Access Software Usage Registry	Remote Access Tools	Anomaly
Protocols passing authentication in cleartext	None	Anomaly
Okta New API Token Created	Default Accounts	TTP
AWS Concurrent Sessions From Different Ips	Browser Session Hijacking	TTP
Windows Privileged Group Modification	Local Account, Domain Account	TTP
Detect IPv6 Network Infrastructure Threats	Hardware Additions, Network Denial of Service, ARP Cache Poisoning	TTP
Gdrive suspicious file sharing	Phishing	Hunting
Detect Remote Access Software Usage FileInfo	Remote Access Tools	Anomaly
PowerShell Start or Stop Service	PowerShell	Anomaly
Windows Kerberos Local Successful Logon	Steal or Forge Kerberos Tickets	TTP
ASL AWS Create Access Key	Cloud Account	Hunting
Windows Access Token Manipulation SeDebugPrivilege	Create Process with Token	Anomaly
Windows LSA Secrets NoLMhash Registry	LSA Secrets	TTP
Detect Remote Access Software Usage DNS	Remote Access Tools	Anomaly
Windows Impair Defense Disable Win Defender Network Protection	Disable or Modify Tools	TTP
Detect Path Interception By Creation Of program exe	Path Interception by Unquoted Path	TTP
Linux Impair Defenses Process Kill	Disable or Modify Tools	Hunting
ASL AWS Credential Access RDS Password reset	Brute Force, Cloud Accounts	TTP
Azure AD Service Principal New Client Credentials	Additional Cloud Credentials	TTP
Kerberos Service Ticket Request Using RC4 Encryption	Golden Ticket	TTP
Gsuite Drive Share In External Email	Exfiltration to Cloud Storage	Anomaly
Okta Multi-Factor Authentication Disabled	Multi-Factor Authentication	TTP
Detect Remote Access Software Usage File	Remote Access Tools	Anomaly
Windows Remote Service Rdpwinst Tool Execution	Remote Desktop Protocol	TTP
Unusual Number of Computer Service Tickets Requested	Valid Accounts	Hunting
PowerShell Invoke CIMMethod CIMSession	Windows Management Instrumentation	Anomaly
Okta Multiple Failed MFA Requests For User	Multi-Factor Authentication Request Generation	Anomaly
Detect Excessive User Account Lockouts	Local Accounts	Anomaly
Detect New Local Admin account	Local Account	TTP
Windows SpeechRuntime COM Hijacking DLL Load	Distributed Component Object Model	TTP
Windows Impair Defense Disable Win Defender Signature Retirement	Disable or Modify Tools	TTP
ASL AWS Concurrent Sessions From Different Ips	Browser Session Hijacking	Anomaly
Suspicious Computer Account Name Change	Domain Accounts	TTP
Windows Credentials from Web Browsers Saved in TEMP Folder	Credentials from Web Browsers	TTP
O365 Multiple Failed MFA Requests For User	Multi-Factor Authentication Request Generation	TTP
Windows PowerShell Export PfxCertificate	Private Keys, Steal or Forge Authentication Certificates	Anomaly
Rubeus Kerberos Ticket Exports Through Winlogon Access	Pass the Ticket	TTP
AdsiSearcher Account Discovery	Domain Account	TTP
Detect Remote Access Software Usage Traffic	Remote Access Tools	Anomaly
Rubeus Command Line Parameters	Pass the Ticket, Kerberoasting, AS-REP Roasting	TTP
Azure AD Multi-Factor Authentication Disabled	Multi-Factor Authentication, Cloud Accounts	TTP
Internal Vulnerability Scan	Network Service Discovery, Vulnerability Scanning	TTP
Detect Remote Access Software Usage Process	Remote Access Tools	Anomaly
Detect New Login Attempts to Routers	None	TTP
Windows Hunting System Account Targeting Lsass	LSASS Memory	Hunting
PingID New MFA Method After Credential Reset	Device Registration, Multi-Factor Authentication, Multi-Factor Authentication Request Generation	TTP
Windows System LogOff Commandline	System Shutdown/Reboot	Anomaly
Detect Remote Access Software Usage URL	Remote Access Tools	Anomaly
GCP Kubernetes cluster pod scan detection	Cloud Service Discovery	Hunting
Azure AD Privileged Role Assigned	Additional Cloud Roles	TTP
Windows Non-System Account Targeting Lsass	LSASS Memory	TTP
GCP Successful Single-Factor Authentication	Cloud Accounts, Cloud Accounts	TTP
Windows Password Managers Discovery	Password Managers	Anomaly
Windows Possible Credential Dumping	LSASS Memory	TTP
Cisco NVM - Rclone Execution With Network Activity	Exfiltration to Cloud Storage	Anomaly
Nginx ConnectWise ScreenConnect Authentication Bypass	Exploit Public-Facing Application	TTP
Azure AD User Enabled And Password Reset	Account Manipulation	TTP
PowerShell Invoke WmiExec Usage	Windows Management Instrumentation	TTP
Azure AD PIM Role Assigned	Additional Cloud Roles	TTP
Windows Create Local Account	Local Account	Anomaly
Okta Mismatch Between Source and Response for Verify Push Request	Multi-Factor Authentication Request Generation	TTP
Windows Credentials from Password Stores Chrome Login Data Access	Query Registry	Anomaly
ASL AWS IAM Assume Role Policy Brute Force	Brute Force, Cloud Infrastructure Discovery	TTP
Permission Modification using Takeown App	File and Directory Permissions Modification	Anomaly
Access LSASS Memory for Dump Creation	LSASS Memory	TTP
Windows AD DSRM Password Reset	Account Manipulation	TTP
Windows Credential Dumping LSASS Memory Createdump	LSASS Memory	TTP
Cisco Secure Firewall - Connection to File Sharing Domain	Web Protocols, External Proxy, Ingress Tool Transfer, Exfiltration to Cloud Storage, Tool	Anomaly
GCP Multi-Factor Authentication Disabled	Multi-Factor Authentication, Cloud Accounts	TTP
Windows Event Logging Service Has Shutdown	Clear Windows Event Logs	Hunting
Detect Credential Dumping through LSASS access	LSASS Memory	TTP
Local Account Discovery With Wmic	Local Account	Hunting
Azure AD Privileged Role Assigned to Service Principal	Additional Cloud Roles	TTP
O365 Privileged Role Assigned	Additional Cloud Roles	TTP
Windows System Shutdown CommandLine	System Shutdown/Reboot	Anomaly
ASL AWS Network Access Control List Deleted	Cloud Firewall	Anomaly
Internal Horizontal Port Scan NMAP Top 20	Network Service Discovery	TTP
Windows Service Stop Attempt	Service Stop	Hunting
Kerberos TGT Request Using RC4 Encryption	Use Alternate Authentication Material	TTP
Dump LSASS via comsvcs DLL	LSASS Memory	TTP
Windows System Reboot CommandLine	System Shutdown/Reboot	Hunting
Windows Impair Defense Disable Defender Protocol Recognition	Disable or Modify Tools	TTP
Azure AD Concurrent Sessions From Different Ips	Browser Session Hijacking	TTP
Windows RDP Login Session Was Established	Remote Desktop Protocol	Anomaly
Azure AD New MFA Method Registered For User	Multi-Factor Authentication	TTP
Azure AD New Federated Domain Added	Trust Modification	TTP
Windows AD DSRM Account Changes	Account Manipulation	TTP
Windows Credential Access From Browser Password Store	Query Registry	Anomaly
Windows Modify Registry Tamper Protection	Modify Registry	TTP
Azure AD Privileged Authentication Administrator Role Assigned	Security Account Manager	TTP
GCP Multiple Failed MFA Requests For User	Cloud Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation	TTP
Windows Impair Defenses Disable AV AutoStart via Registry	Modify Registry	TTP
Windows Terminating Lsass Process	Disable or Modify Tools	Anomaly
Mimikatz PassTheTicket CommandLine Parameters	Pass the Ticket	TTP
Cisco Secure Firewall - Remote Access Software Usage Traffic	Remote Access Tools	Anomaly
Azure AD Application Administrator Role Assigned	Additional Cloud Roles	TTP
Okta Authentication Failed During MFA Challenge	Cloud Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation	TTP
Windows Local Administrator Credential Stuffing	Credential Stuffing	TTP
GCP Authentication Failed During MFA Challenge	Cloud Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation	TTP
Windows Impair Defense Disable PUA Protection	Disable or Modify Tools	TTP
Windows RMM Named Pipe	SMB/Windows Admin Shares, Process Injection, Inter-Process Communication	Anomaly
Azure AD New MFA Method Registered	Device Registration	TTP
Windows Credentials from Password Stores Chrome Copied in TEMP Dir	Credentials from Web Browsers	TTP
Citrix ADC and Gateway Unauthorized Data Disclosure	Exploit Public-Facing Application	TTP
Linux Auditd Find Credentials From Password Stores	Password Managers	TTP
O365 Concurrent Sessions From Different Ips	Browser Session Hijacking	TTP
Azure AD Global Administrator Role Assigned	Additional Cloud Roles	TTP
Monitor Email For Brand Abuse	None	TTP
Creation of lsass Dump with Taskmgr	LSASS Memory	TTP
Cisco Smart Install Port Discovery and Status	Exploit Public-Facing Application	TTP
Windows Cisco Secure Endpoint Related Service Stopped	Inhibit System Recovery	Anomaly
Domain Group Discovery with Adsisearcher	Domain Groups	TTP
Internal Vertical Port Scan	Network Service Discovery	TTP
Okta Suspicious Use of a Session Cookie	Steal Web Session Cookie	Anomaly
Windows Credentials from Password Stores Chrome LocalState Access	Query Registry	Anomaly
Detect Rogue DHCP Server	Hardware Additions, Network Denial of Service, Adversary-in-the-Middle	TTP
Windows Security And Backup Services Stop	Inhibit System Recovery	TTP
Windows Impair Defense Disable Defender Firewall And Network	Disable or Modify Tools	TTP
Disable Windows Behavior Monitoring	Disable or Modify Tools	TTP
Azure AD PIM Role Assignment Activated	Additional Cloud Roles	TTP
Linux Auditd Hardware Addition Swapoff	Hardware Additions	Anomaly
Linux Hardware Addition SwapOff	Hardware Additions	Anomaly
Windows Impair Defense Deny Security Software With Applocker	Disable or Modify Tools	TTP
Windows Security Account Manager Stopped	Service Stop	TTP
GetAdGroup with PowerShell Script Block	Domain Groups	Hunting
Windows Disable or Stop Browser Process	Disable or Modify Tools	TTP
Windows PowerShell FakeCAPTCHA Clipboard Execution	PowerShell, Windows Command Shell, Malicious Link	TTP
AWS Multi-Factor Authentication Disabled	Multi-Factor Authentication, Cloud Accounts, Multi-Factor Authentication Request Generation	TTP
Windows Create Local Administrator Account Via Net	Local Account	Anomaly
Linux Auditd Find Credentials From Password Managers	Password Managers	TTP
O365 Privileged Role Assigned To Service Principal	Additional Cloud Roles	TTP

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Ivanti VTM Audit	Other	`ivanti_vtm_audit`	`ivanti_vtm`
AWS CloudWatchLogs VPCflow	AWS	`aws:cloudwatchlogs:vpcflow`	`aws_cloudwatchlogs_vpcflow`
Cisco Secure Firewall Threat Defense Connection Event	Other	`cisco:sfw:estreamer`	`not_applicable`
ASL AWS CloudTrail	AWS	`aws:asl`	`aws_asl`
AWS CloudTrail ModifyDBInstance	AWS	`aws:cloudtrail`	`aws_cloudtrail`
Okta	Other	`OktaIM2:log`	`Okta`
Sysmon EventID 13	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
AWS CloudTrail DescribeEventAggregates	AWS	`aws:cloudtrail`	`aws_cloudtrail`
Windows Event Log Security 4744	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4790	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4731	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4727	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4754	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4759	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4749	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4756	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4783	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Cisco IOS Logs	Other	`cisco:ios`	`cisco:ios`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Powershell Script Block Logging 4104	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-PowerShell/Operational`
Windows Event Log Security 4624	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4703	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 22	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon for Linux EventID 1	Linux	`sysmon:linux`	`Syslog:Linux-Sysmon/Operational`
Azure Active Directory	Azure	`azure:monitor:aad`	`Azure AD`
Windows Event Log Security 4769	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
G Suite Drive	Other	`gsuite:drive:json`	`http:gsuite`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4720	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4732	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 7	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4781	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
O365 UserLoginFailed	Other	`o365:management:activity`	`o365`
Sysmon EventID 10	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Palo Alto Network Traffic	Network	`pan:traffic`	`not_applicable`
Azure Active Directory Disable Strong Authentication	Azure	`azure:monitor:aad`	`Azure AD`
PingID	Other	`XmlWinEventLog`	`XmlWinEventLog:Security`
Palo Alto Network Threat	Network	`pan:threat`	`not_applicable`
Azure Active Directory Add member to role	Azure	`azure:monitor:aad`	`Azure AD`
Google Workspace	Other	`gws:reports:login`	`google_workspace`
Cisco Network Visibility Module Flow Data	Network	`cisco:nvm:flowdata`	`not_applicable`
Nginx Access	Other	`nginx:plus:kv`	`/var/log/nginx/access.log`
Azure Active Directory Enable account	Azure	`azure:monitor:aad`	`Azure AD`
Azure Active Directory Update user	Azure	`azure:monitor:aad`	`Azure AD`
Azure Active Directory Reset password (by admin)	Azure	`azure:monitor:aad`	`Azure AD`
Windows Event Log Security 4663	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4794	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 1100	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Office 365 Universal Audit Log	Other	`o365:management:activity`	`o365`
Windows Event Log Security 4768	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Azure Active Directory User registered security info	Azure	`azure:monitor:aad`	`Azure AD`
Azure Active Directory Set domain authentication	Azure	`azure:monitor:aad`	`Azure AD`
Windows Event Log Security 4625	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Google Workspace login_failure	Other	`gws:reports:admin`	`gws:reports:admin`
Sysmon EventID 17	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 18	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Suricata	Other	`suricata`	`not_applicable`
Linux Auditd Execve	Linux	`auditd`	`auditd`
O365 UserLoggedIn	Other	`o365:management:activity`	`o365`
Splunk Stream TCP	Splunk	`stream:tcp`	`stream:tcp`
Windows Event Log System 7036	Windows	`XmlWinEventLog`	`XmlWinEventLog:System`
AWS CloudTrail DeactivateMFADevice	AWS	`aws:cloudtrail`	`aws_cloudtrail`
AWS CloudTrail DeleteVirtualMFADevice	AWS	`aws:cloudtrail`	`aws_cloudtrail`

References

Source: GitHub | Version: 2