#unc3944 — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #unc3944, aggregated by home.social.
-
Jak Windows śledzi użytkowników przez Global Device ID (GDID)? Czyli o operacji FBI i wpadce nastoletniego przestępcy
19-letni Petera Stokes to członek głośnej grupy Scattered Spider znanej też jako Octo Tempest, UNC3944 i 0ktapus, która zasłynęła z wyrafinowanych ataków socjotechnicznych, SIM swappingu i ataków ransomware. Wpadł, bo do przeprowadzania ataków korzystał z Windowsa. I choć jak na “hakera” przystało korzstał z VPN-a aby ukryć swój IP, to za bardzo mu to nie pomogło…
VPN nie pomógł. Zgubił go Windows i GDID
Z 39-stronicowego dokumentu sądowego wynika, że FBI o pomoc w namierzeniu tożsamości włamywacza poprosiło Microsoft, dzięki czemu udało się powiązać adres IP z tzw. Global Device ID (GDID). Co to jest GDID? To unikatowy identyfikator urządzenia, który system Windows na stałe przypisuje do konkretnej instalacji sprzętowej lub maszyny wirtualnej.
Nawet jeśli zmieniasz IP przez VPN, twój system operacyjny nieustannie komunikuje się z serwerami Microsoftu, wysyłając w tle telemetrię opisaną tym samym identyfikatorem GDID.
W logach przekazanych FBI znalazły się dowody na to, że ten sam GDID, który logował się do usług VPN, odwiedzał też strony ofiar gangu ScatteredSpider oraz platformy gamingowe. Microsoft miał rekordy wskazujące, że urządzenie z danym GDID 12 maja 2025 o 19:21 UTC weszło m.in. na stronę zakładania konta ngrok, dokładnie wtedy, kiedy utworzono konto ngrok użyte w ataku. Potem GDID porównano z aktywnością kont przypisywanych Stokesowi: Facebooka, Snapchata, Apple i Ubisoft/Growtopia oraz z podróżami do Estonii, Nowego Jorku i Tajlandii.
Powyższa ilustracja została syntetycznie wygenerowana z wykorzystaniem sieci neuronowej podczas procesu inferencji modelu [...]#0Ktapus #GDID #Inwigilacja #IP #Metadane #Microsoft #OctoTempest #PeterStokes #Ransomware #ScatteredSpider #Socjotechnika #UNC3944 #VPN #Windows
https://niebezpiecznik.pl/post/windows-inwigilacja-prywatnosc-uzytkownikow-global-device-id-gdid/
-
Scattered Spider Hacker Noah Michael Urban Jailed for 10 Years https://hackread.com/scattered-spider-hacker-noah-michael-urban-jailed/ #NoahMichaelUrban #ScatteredSpider #Cybersecurity #CyberAttack #SIMSwapping #CyberCrime #UNC3944
-
Scattered Spider Hacker Noah Michael Urban Jailed for 10 Years – Source:hackread.com https://ciso2ciso.com/scattered-spider-hacker-noah-michael-urban-jailed-for-10-years-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #NoahMichaelUrban #ScatteredSpider #cybersecurity #CyberAttack #SIMSwapping #CyberCrime #Hackread #UNC3944
-
SIM-Swapper, Scattered Spider Hacker Gets 10 Years https://krebsonsecurity.com/2025/08/sim-swapper-scattered-spider-hacker-gets-10-years/ #JudgeHarveyE.Schlesinger #Ne'er-Do-WellNews #NoahMichaelUrban #ScatteredSpider #News4Jax.com #ScatterSwine #SIMSwapping #Mailchimp #StarFraud #DoorDash #lastpass #T-Mobile #KingBob #Oktapus #UNC3944 #TheCom #Twilio #Plex #Sosa
-
SIM-Swapper, Scattered Spider Hacker Gets 10 Years
https://krebsonsecurity.com/2025/08/sim-swapper-scattered-spider-hacker-gets-10-years/
#JudgeHarveyE.Schlesinger #Ne'er-Do-WellNews #NoahMichaelUrban #ScatteredSpider #News4Jax.com #ScatterSwine #SIMSwapping #Mailchimp #StarFraud #DoorDash #lastpass #T-Mobile #KingBob #Oktapus #UNC3944 #TheCom #Twilio #Plex #Sosa
-
From Help Desk to Hypervisor: Defending Your VMware vSphere Estate from UNC3944
#UNC3944
https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944 -
Scattered Spider hackers shift focus to aviation, transportation firms
If you work in aviation or transportation, LISTEN
- Scattered Spider is actively targeting your industry.
- They are using trycloudflare.com to deliver Chisel, a FOSS encrypted reverse proxy.
ACTION ITEMS:
- block trycloudflare.com by FQDN.
- make sure you are using IPS or app signatures on your firewalls to detect the chisel traffic.
NOTE: Chisel is encrypted, so you need to be doing full SSL inspection (TLSI) to effectively detect and block the app.
Additional Resources:
Please don't let this fuck up your 4th.
#ScatteredSpider #UNC3944 #Chisel #ChiselMalware #ThreatIntel #CyberSecurity
-
CISOs should fortify help desk and employee defenses, enhance intrusion detection and tracking capabilities, and recognize that paying ransoms is not a viable strategy.
#ScatteredSpider #UNC3944 #Starfraud #ScatterSwine #MuddledLibra #OctoTempest #0katpus.
-
Google Warns UK Retailer Hackers Now Targeting US https://www.securityweek.com/google-warns-uk-retailer-hackers-now-targeting-us/ #ScatteredSpider #DragonForce #Ransomware #ransomware #UNC3944 #retail #US
-
Google Warns UK Retailer Hackers Now Targeting US https://www.securityweek.com/google-warns-uk-retailer-hackers-now-targeting-us/ #ScatteredSpider #DragonForce #Ransomware #ransomware #UNC3944 #retail #US
-
Defending Against UNC3944: Cybercrime Hardening Guidance from the Frontlines
#UNC3944
https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations -
US Charges 5 Suspected MGM Hackers from Scattered Spider Gang – Source:hackread.com https://ciso2ciso.com/us-charges-5-suspected-mgm-hackers-from-scattered-spider-gang-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #ScatteredSpider #cybersecurity #CyberCrime #Hackread #Phishing #UNC3944 #Crypto #MGM
-
US Charges 5 Suspected MGM Hackers from Scattered Spider Gang https://hackread.com/us-charges-suspected-mgm-hackers-scattered-spider/ #ScatteredSpider #Cybersecurity #CyberCrime #Phishing #UNC3944 #Crypto #MGM
-
I just finished a video on #UNC3944 aka #ScatteredSpider.
If $dayjob doesn't get it online ASAP, I'll post it here soon.
Stay tuned...
-
UNC3944 aka ‘Scattered Spider’ Shifts Focus to Data Theft from SaaS Applications https://thecyberexpress.com/unc3944-shifts-focus-to-data-theft-from-saas/ #ThreatIntelligenceNews #TheCyberExpressNews #SoftwareasaService #CybersecurityNews #SaaSApplications #AttackLifecycle #ScatteredSpider #TheCyberExpress #FirewallDaily #ThreatActors #HackerNews #Ransomware #DataTheft #Mandiant #UNC3944 #SaaS
-
From infiltration to crypto-lock sometimes in hours (not days) — as attackers refine tactics, 'speed matters,' experts warn
https://www.databreachtoday.com/as-attackers-refine-tactics-speed-matters-experts-warn-a-24605 #ScatteredSpider #muddledlibra #octotempest #UNC3944 -
#SIMswapping is still a very real thing. Now, it's being used to bypass defense and detection methods within #Azure to gain full #administrative access for #Windows #VirtualMachines. This is pretty advanced, but it's still a big danger. #UNC3944 https://www.scmagazine.com/news/cloud-security/threat-actor-bypasses-detection-protections-in-microsoft-azure-serial-console?external_id=HBwZ-n4B490LDY0Z-dKj&external_id_source=mrkto&mkt_tok=MTg4LVVOWi02NjAAAAGLzUgAlV_uPRm28W067Sf5RayoZQN17Xrk53YEG17z3Gl_7qKsu2bjdUUW2CRUpserJQgXmMB46ieb_G5KrSlLHQGWs_K0TtXaXsrlmIPgkg
#Hacking #ThreatIntelligence #InitialAccess #LateralMovement #Persistence #Cloud #CloudAttackSurface
-
Cryptocurrency exchange operator Coinbase have disclosed an attempted intrusion by #UNC3944/#ScatteredSpider from early February.
The attack used SMS Phishing (#Smishing) to deliver a malicious URL that pointed to a credential harvesting campaign, but thankfully despite an employee falling for the fake login page, they hesitated when the attackers attempted to socially engineer their way past MFA protections.
UNC3944 is a highly capable actor that has only been growing in sophistication since their debut in the 0ktapus campaign of 2022, and one that every organisation should be wary of.
We've summarised the key TTP overlaps between these intrusions and provided some tips on how to enhance the resistance of your MFA solutions against social engineering and MFA fatigue attacks: https://opalsec.substack.com/p/return-of-the-0ktapus?sd=pf
#infosec #cyber #informationsecurity #cybersecurity #security #technology #soc #threatintel #threatintelligence #hacked #hacking #hacker #compromise #coinbase #crypto #cryptocurrencies