Cloud Security Office Hours Banner

Scattered Spider / MGM 2023 — 2023

Step-by-step kill chain mapped to MITRE ATT&CK Cloud, sourced from official post-mortems and primary technical analyses.

September 2023 Critical Okta Azure AD

Scattered Spider / MGM Resorts – LinkedIn OSINT → Vishing Help Desk → Okta Super Admin → Azure AD → 100 ESXi Servers Encrypted

Scattered Spider (UNC3944) compromised MGM Resorts International in September 2023 using a single 10-minute phone call to the IT help desk. Attackers researched an MGM employee on LinkedIn, impersonated them to a help desk agent, obtained an MFA reset, and gained initial access. From there they escalated to Okta Super Administrator, claimed Azure AD tenant-level control, moved laterally across the network, and encrypted over 100 ESXi hypervisors using ALPHV/BlackCat ransomware — causing $100M in losses and a 10-day outage. The entire initial access chain required no technical exploit whatsoever.

$100M+ estimated losses
10 days operational disruption
100+ ESXi hypervisors encrypted
Threat actor: Scattered Spider (UNC3944) + ALPHV/BlackCat RaaS
📄 FBI/CISA Joint Advisory AA23-320A ↗ 📄 MITRE ATT&CK G1015 ↗ 📄 GuidePoint GRIT Analysis ↗ 📄 CrowdStrike — Not a SIMulation ↗
🔍 Reconnaissance — LinkedIn OSINT
01
Attacker researches MGM employee identity on LinkedIn to build convincing pretext
T1591 – Gather Victim Org Info T1589.002 – Email Addresses

Before making any call, the attacker used LinkedIn to identify an MGM Resorts employee — gathering their full name, job title, and enough personal and professional detail to convincingly impersonate them to an IT help desk agent. Mandiant confirmed from forensic recordings of these call center attacks that the threat actors already possessed PII on their victims before calling — including SSN last four digits, dates of birth, and manager names — to pass standard help desk identity verification. Scattered Spider are native English speakers, removing any accent barrier that typically flags social engineering attempts from non-Western threat actors.

Primary OSINT source: LinkedIn — full name, job title, department, manager name
PII used to pass verification (Mandiant confirmed): Last 4 digits of SSN, date of birth, manager name and job title
Why it worked: Help desks are trained to be helpful — suspicion of an "employee" feels obstructive
Mandiant: "The level of sophistication in these social engineering attacks is evident in both the extensive research performed on potential victims and the high success rate"
OSINTLinkedInT1591Native English Speaker
📞 Initial Access — Vishing the Help Desk
02
Single phone call to MGM IT help desk — attacker impersonates employee and requests MFA reset
T1566.004 – Phishing: Voice (Vishing) T1656 – Impersonation

The attacker called MGM's IT help desk, impersonated the employee identified on LinkedIn, and requested a multi-factor authentication reset. Mandiant confirmed from forensic recordings that the consistent pretext used was claiming to be receiving a new phone — a routine scenario that naturally requires an MFA reset. The agent had no way to verify the caller's true identity beyond the PII provided, which matched what the attacker had gathered. The call lasted approximately 10 minutes.

Attack vector: Phone call (vishing) — zero technical skill required for this step
Pretext used (Mandiant confirmed): "I'm receiving a new phone and need my MFA reset" — a routine, unsuspicious request
Verification bypassed with: SSN last 4 digits, date of birth, manager name — all pre-researched
Verification failure: Help desk had no phishing-resistant out-of-band identity verification
ALPHV statement: "All SCATTERED SPIDER did to get into MGM was hop on LinkedIn, find an employee, then call the help desk"
VishingMFA ResetNew Phone PretextHelp Desk AbuseT1566.004T1656
🔍 Internal Reconnaissance — SharePoint Documentation Mining
03
Internal SharePoint searched for VPN, VDI, and remote access documentation
T1213.002 – Sharepoint T1046 – Network Service Discovery

With initial account access, the attacker's first move was not to escalate immediately — it was to read. Mandiant confirmed that UNC3944 consistently searched victims' internal SharePoint sites for help guides and documentation covering VPNs, virtual desktop infrastructure (VDI), and remote telework utilities. This gave them a roadmap of the environment drawn entirely from the victim's own internal documentation, dramatically accelerating lateral movement planning without triggering any security tooling.

Platform searched: Microsoft SharePoint — internal intranet and documentation portal
Content targeted (Mandiant confirmed): VPN setup guides, VDI connection instructions, remote telework utilities documentation
Why effective: Internal IT docs contain exactly the information an attacker needs — network topology, tool names, access paths
Detection gap: SharePoint search activity by a recently-reset account is virtually indistinguishable from legitimate onboarding
SharePointInternal ReconVPN DocsVDI DocsT1213.002
🔑 Credential & Identity Access — Okta Super Admin
04
Okta Super Administrator access obtained via compromised account — MFA removed from admin accounts
T1078.004 – Cloud Accounts T1098 – Account Manipulation

With initial account access, the attacker escalated to Okta Super Administrator. Mandiant additionally confirmed a technique not widely reported: UNC3944 used Okta's self-assignment feature to assign the compromised account to every application in the Okta instance — giving them SSO access to every federated application simultaneously, and a visual inventory of every app tile available in the Okta portal. They also configured a second Identity Provider as an impersonation app and stripped MFA from targeted admin accounts.

Platform abused: Okta — identity provider for MGM's entire enterprise application estate
Privilege achieved: Super Administrator — full control over all identity for downstream applications
Mandiant confirmed technique: Okta self-assignment to every app in the instance — instant access to all SSO-protected applications
IdP abuse: Second Identity Provider configured as "impersonation app" — could act as any user in the org
MFA stripped: Second-factor requirements removed from authentication policies for targeted accounts
Okta Super AdminSelf-Assignment All AppsIdP ImpersonationMFA StrippedT1078.004T1098
☁️ Cloud Privilege Escalation — Azure AD + New VM Persistence
05
Azure AD super administrator access claimed — new virtual machines created in vSphere/Azure for persistent foothold
T1078.004 – Cloud Accounts T1578.002 – Create Cloud Instance

Having compromised Okta, the attacker pivoted to MGM's Azure AD tenant and claimed super administrator privileges including Tenant Root Group management permissions. Mandiant additionally confirmed a persistence technique specific to this group: UNC3944 accessed vSphere and Azure through SSO applications to create entirely new virtual machines, from which all follow-on activities were conducted. These attacker-controlled VMs had Microsoft Defender and Windows telemetry disabled, making forensic investigation significantly harder.

Cloud platform: Microsoft Azure AD — highest possible tenant permissions claimed
Mandiant confirmed persistence: New VMs created in vSphere and Azure via SSO — used as clean base for all further activity
VM hardening by attacker: MAS_AIO and privacy-script.bat used to remove Microsoft Defender and Windows telemetry
PCUnlocker ISO: Attached to existing VMs via vCenter to reset local admin passwords, bypassing domain controls
Impact: Cloud activity sourced from inside the environment — malicious traffic indistinguishable from legitimate traffic
Azure AD Tenant RootNew VM PersistenceDefender DisabledPCUnlockerT1078.004T1578.002
🕵️ Lateral Movement & Persistence — LOTL + SaaS Abuse
06
Living-off-the-land lateral movement — RDP, CrowdStrike RTR abuse, Mimikatz, IMPACKET, multiple tunnelling tools
T1021.001 – Remote Desktop Protocol T1562 – Impair Defenses

With domain-level cloud access, the attacker moved laterally using legitimate tools already present in the environment. Mandiant confirmed several techniques not widely reported: UNC3944 created API keys inside CrowdStrike's external console to run commands (whoami, quser) via the Real Time Response module — effectively using the victim's own EDR as a remote access tool. They also used Mimikatz, ADRecon, and IMPACKET from attacker-controlled VMs, along with multiple tunnelling tools for persistent C2.

CrowdStrike RTR abuse (Mandiant confirmed): API keys created in CrowdStrike Falcon console — RTR module used to run whoami and quser
Credential theft: Mimikatz, "SecretServerSecretStealer" PowerShell script, ADRecon
Tunnelling tools (Mandiant confirmed): NGROK, RSOCX, Localtonet, Tailscale, Remmina
Python libraries: IMPACKET installed on attacker VMs
EDR evasion: BYOVD — CVE-2015-2291 Intel driver used to disable endpoint security agents
SaaS accessed (Mandiant confirmed): vCenter, CyberArk, Salesforce, Azure, CrowdStrike, AWS, GCP — all via Okta SSO
CrowdStrike RTR AbuseMimikatzIMPACKETNGROKRSOCXBYOVDT1021.001T1562
📤 Exfiltration — Data Theft Before Encryption
07
Sensitive data exfiltrated ahead of ransomware deployment — double extortion strategy
T1657 – Financial Theft / Extortion T1530 – Data from Cloud Storage

Before deploying ransomware, the attacker exfiltrated sensitive data from MGM's environment — establishing the leverage needed for double extortion. They threatened to publish the stolen data unless the ransom was paid, independent of whether MGM could recover from encryption using backups. Caesars Entertainment, hit in a similar attack at the same time, paid approximately $15 million ransom to prevent data publication.

Strategy: Double extortion — encrypt AND threaten to leak, maximising pressure
Caesars parallel: Caesars paid ~$15M ransom; MGM refused and incurred ~$100M in losses instead
ALPHV statement: Claimed to still have access to MGM infrastructure and threatened further attacks
Data targeted: Customer PII, loyalty programme data, internal credentials
Exfil method: Legitimate cloud storage and remote access tools — no custom malware required
Double ExtortionData TheftT1657T1530Ransomware-as-a-Service
💥 Impact — 100+ ESXi Hypervisors Encrypted
08
ALPHV/BlackCat ransomware deployed against 100+ ESXi hypervisors — 10-day outage
T1486 – Data Encrypted for Impact T1490 – Inhibit System Recovery

On September 11, 2023 — after MGM failed to respond to the attacker's contact attempts — ALPHV/BlackCat ransomware was deployed against over 100 ESXi hypervisors across MGM's Las Vegas properties. The rapid encryption of 100+ VMware ESXi servers caused a 36+ hour initial outage and disrupted casino floor operations, hotel check-ins, digital room keys, ATMs, and slot machines for 10 days across multiple Las Vegas properties. MGM refused to pay the ransom.

Ransomware: ALPHV/BlackCat — deployed via RaaS affiliate relationship with Scattered Spider
Targets: 100+ VMware ESXi hypervisors running MGM's production VMs
Timeline: Deployed Sept 11, 2023 — after MGM ignored attacker contact attempts for 24hrs
Impact: Casino floors, hotel check-ins, digital room keys, ATMs, slot machines — all disrupted
Financial impact: ~$100M losses + $45M class-action lawsuit settlement
MGM decision: Refused to pay ransom — incurred full remediation cost instead
ALPHV/BlackCatESXi Encryption100+ Hypervisors$100M LossT1486T1490

🛡 How to Defend Against This Chain

Implement phishing-resistant MFA (FIDO2/passkeys) and never allow help desk agents to reset MFA via phone. This single control breaks the entire initial access chain. The attack required no technical exploit — it required one help desk agent following standard procedure. Move MFA resets to an out-of-band workflow requiring manager approval and visual identity verification (video call with government ID).
Treat Okta as a Tier 0 asset — the same way you treat Active Directory. Super Administrator access in Okta gives an attacker control over every application federated to it. Require hardware security keys for all Okta admin access, enable Okta ThreatInsight, and alert immediately on new Identity Provider configuration or authenticator resets for admin accounts.
Monitor and alert on Okta Org2Org federation changes and new IdP configurations. The attacker configured a second Identity Provider to impersonate any user in the organisation. New IdP additions should require change control approval and trigger immediate SOC review — they are almost never legitimate outside of planned migrations.
Segment your ESXi environment from the corporate identity plane. ESXi hypervisors should not be reachable from identities that live in the same plane as corporate Okta and Azure AD. Separate management networks, dedicated credentials not linked to SSO, and jump hosts with hardware MFA are the minimum bar for hypervisor access.
Detect LOTL tools in unusual contexts. ngrok, Tailscale, and Remmina are legitimate tools — but their presence on server infrastructure or in a SOC alert at 2am is not. Build detection rules for tunnelling tools on non-developer endpoints and alert on new VPN mesh clients enrolled outside your MDM.
Have an offline, immutable backup of ESXi VM configurations and snapshots. The rapid encryption of 100+ hypervisors succeeded partly because MGM lacked good backup and restoration practices. Offline backups that can't be reached via domain credentials are the last line of defence when ransomware hits the hypervisor layer.
Run tabletop exercises specifically for the "help desk social engineering → Okta → cloud" scenario. This is now the most documented and replicated attack chain in enterprise security. CISA and FBI have both published guidance on it. If your IR plan doesn't include a playbook for identity provider compromise as an initial step, update it today.