The craziest thing about the entire Scattered Spider trilogy is how simple they operated and how effective it was They didn't utilize 0day exploits. They didn't utilize novel and "undetectable" malware. They didn't exploit N-days or try to find vulnerable external facing machines. All they did was call the help desk. That's it. That's literally it. Scattered Spider performed basic reconnaissance from social media (LinkedIn), investor websites, and dug up any information they could about the company. Then they called the help desk. That's how they compromised banks, critical infrastructure, casinos, car manufacturers, petroleum companies, luxury brands, government entities, air lines, and record labels. Once they got access they used basic open source tooling from GitHub. It was never anything super fancy. All of these companies invested heavily into Threat Intelligence, SOC analysts, Endpoint Detection Response software, DFIR experts, and anything else you can think of and it was defeated by doing basic research on the company and calling the help desk We're so fucked

Im telling you right now bro, if a girl joined in on their Scattered Spider spree, it would have been x100 worse. Imagine some girl calls in. She tells the dork at the help desk that she's confused, doesn't understand computers, and says shit like "hehe you sound cute" or "wow you're so smart". Bro would fold in a nanosecond. All security protocols right out the fuckin window. That would probably be the first compliment that mfer on helpdesk has had in his life. They'd give that chick access to the domain controller if she wanted Anyway, that's my nightmare fuel for you.