Scattered Spider reportedly turned a compromised chief financial officer’s identity into control of cloud, virtualization, privileged-access, email, and data systems during a four-day intrusion in May 2025. The incident, disclosed by ReliaQuest on June 27, 2025, began when the attackers persuaded an IT help desk to reset the CFO’s authentication factors after Microsoft MFA blocked their initial login attempts.
The victim was not publicly named in the principal reporting. ReliaQuest attributed the attack to Scattered Spider, while the exact method used to obtain the original Oracle Cloud credentials remained unconfirmed. The incident is best understood not as a simple MFA bypass, but as an identity-recovery failure that allowed one executive account to become a route into multiple administrative control planes.
As an Amazon Associate I earn from qualifying purchases.
The attack chain at a glance
| Phase | Reported activity | Why it mattered |
|---|---|---|
| Initial access | Attackers used credentials associated with the CFO’s Oracle Cloud account. | Created a credible executive-impersonation scenario. |
| Authentication failure | Initial external login attempts were blocked by MFA. | Shows that MFA initially worked. |
| Help-desk takeover | The attackers impersonated the CFO and persuaded staff to reset the MFA device and credentials. | Converted an account-recovery process into the entry point. |
| Cloud discovery | They enumerated Microsoft Entra ID and reviewed SharePoint documentation. | Revealed privileged identities, service principals, infrastructure, and procedures. |
| Virtualization pivot | They reached VMware Horizon, VPN infrastructure, and vCenter, then obtained an NTDS.dit database. |
Expanded access into on-premises identity systems through the virtualization layer. |
| Secret expansion | They accessed a CyberArk vault and extracted secrets associated with more than 1,400 accounts. | Turned one compromised identity into access at enterprise scale. |
| Tenant control | They obtained or assigned Exchange Administrator and Global Administrator privileges and accessed service principals, mailboxes, Snowflake, and other resources. | Enabled identity takeover, surveillance, and broad cloud administration. |
| Counter-response | They restored disabled accounts, impersonated responders, ran Azure commands, and deleted Azure Firewall policy rule-collection groups. | Interfered with containment and disrupted operations. |
| Resolution | Microsoft helped the victim regain control of its Entra ID tenant. | The attackers were evicted before reported ransomware deployment. |
This timeline is based on Dark Reading’s summary of ReliaQuest’s findings and secondary reporting from CFO.com.
MFA stopped the first login—but not the reset process
The most important distinction is between MFA as an authentication control and MFA enrollment as an administrative workflow. The attackers reportedly attempted to sign in from an external IP address, but MFA blocked those attempts. They then called the IT help desk while impersonating the CFO.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
According to the reported account, the callers used personal information—including the CFO’s birth date and the last four digits of the Social Security number—to make the request credible. Help-desk staff reset the executive’s MFA device and credentials, allowing the attackers to use the legitimate identity and single-sign-on path.
A phone call is not proof of identity, and information such as a birth date, partial Social Security number, employee number, caller ID, or public biographical details should not be sufficient to replace a privileged user’s authentication factor. Executive status and urgency can make social engineering more effective because support staff may feel pressure to restore access quickly.
ReliaQuest has separately reported Scattered Spider-linked phishing infrastructure targeting executives and administrators, including CFOs, COOs, and CISOs. That research describes credential harvesters and typosquatted domains, but it does not establish that a phishing page was the original credential-theft method in this particular incident. (ReliaQuest)
From the CFO account to an enterprise map
Once inside, the attackers reportedly enumerated Microsoft Entra ID users, groups, roles, and service principals. They also reviewed SharePoint documentation describing the organization’s technology environment.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Internal documentation can be as valuable as a technical exploit. Network diagrams, VPN procedures, virtualization details, naming conventions, support processes, and lists of administrative roles can give an intruder an attack map. In this case, the CFO account reportedly led to information about VMware, VPN access, privileged accounts, Snowflake resources, and other critical applications.
The CFO was therefore an entry point rather than necessarily the ultimate target. The objective expanded from one executive’s mailbox or cloud account to the identity and management systems that controlled the wider environment.
The virtualization pivot
The reported path moved through VMware Horizon, VPN infrastructure, and vCenter. Attackers reportedly created or restored virtual machines, mounted virtual drives, and obtained NTDS.dit, the Active Directory database containing password hashes and other directory data.
Free tools Windows power users keep installed
One-click scans. No signup required.
This matters because virtualization-management activity can fall outside the visibility of ordinary endpoint defenses. EDR installed inside a guest operating system may not fully show what an attacker does through vCenter, ESXi, virtual storage, snapshots, templates, or virtual networking. The VMware management plane needs its own privileged identities, segmentation, logging, and detection.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
CSO Online’s technical context likewise highlights the importance of combining guest-level EDR with hypervisor and management-plane telemetry.
Why the CyberArk access changed the scale of the incident
The attackers reportedly accessed a CyberArk privileged-access vault and obtained secrets associated with more than 1,400 accounts. That wording is important: the available reporting supports “account-related secrets,” not necessarily 1,400 individual passwords.
PAM reduces routine standing privilege, but a compromised vault or vault-administration path can become a concentration point for enterprise credentials. The reported volume and speed of retrieval suggested automated or programmatic use. Those secrets could support lateral movement with legitimate identities, making the activity harder to distinguish from normal administration.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →After a PAM compromise, changing the original CFO password is not enough. The organization must identify every potentially exposed secret, disable attacker-controlled vault accounts and sessions, revoke tokens and keys, and rotate credentials in a controlled dependency order. Identity, domain, cloud, virtualization, backup, and security-management accounts generally require priority treatment.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Taking over identity, email, and the response process
The attackers reportedly obtained or assigned powerful privileges, including Exchange Administrator and Global Administrator. Reporting also described access to employee mailboxes, including the CISO’s mailbox, service-principal identities, Azure resources, Snowflake environments, and other critical applications.
A particularly dangerous reported step was assigning Global Administrator privileges to a service-principal identity. Non-human identities may have different monitoring, ownership, lifecycle, and authentication controls from human administrators, and they can be overlooked during account reviews.
After defenders began remediation, the attackers reportedly restored access to accounts that responders had disabled, pivoted to other service principals, intercepted an internal warning email, and impersonated a legitimate team member in a reply. ReliaQuest characterized this as the first time its researchers had observed Scattered Spider actively fighting incident responders to retain cloud control. That is ReliaQuest’s observation, not a universal industry-wide historical claim.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallMicrosoft ultimately helped the victim regain control of the Entra ID tenant. Provider intervention can be essential when attackers control tenant-wide administration, but it is not a substitute for a customer-owned recovery plan and out-of-band escalation contacts.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
The “scorched-earth” phase
ReliaQuest described the final phase as “scorched earth,” a descriptive label for destructive post-discovery behavior—not the name of a malware family or formal operation. The reported activity included Azure command execution, attempts to regain Global Administrator control, and deletion of Azure Firewall policy rule-collection groups.
This behavior suggests that the attackers shifted from stealth and persistence toward disruption and denial of recovery after defenders detected them. No ransomware was reportedly deployed before the attackers were fully evicted. That does not make the incident minor: it involved identity takeover, exposure of large numbers of secrets, mailbox access, data access, response interference, and destructive cloud changes.
The accurate description is a credential-driven intrusion with privilege escalation, data and identity access, destructive disruption, and possible pre-ransomware activity—not a confirmed ransomware deployment.
What defenders should change
Harden help-desk recovery
- Require phishing-resistant verification for MFA resets involving executives, administrators, finance leaders, and other sensitive accounts.
- Use an independent callback to a pre-registered number or approval from a separate security team.
- Require dual approval for MFA-factor replacement, privileged password resets, and authentication-method changes.
- Alert on after-hours resets, repeated resets, unusual caller patterns, and changes followed by unfamiliar logins.
- Train staff that urgency and seniority are risk indicators, not reasons to bypass procedure.
Reduce identity privilege
- Eliminate standing Global Administrator access where possible and use just-in-time, time-bound elevation.
- Separate ordinary employee accounts from dedicated administrator accounts.
- Inventory service principals, assign owners, rotate their credentials, and alert on privilege changes.
- Monitor new Global Administrator and Exchange Administrator assignments, recovery-factor changes, OAuth grants, and Conditional Access exclusions.
- Protect and continuously monitor emergency break-glass accounts.
Prepare for a PAM compromise
- Identify every secret that was accessed, exported, or potentially exposed.
- Disable attacker-controlled vault accounts and sessions.
- Rotate identity, domain, cloud, virtualization, backup, and security-management credentials in dependency order.
- Revoke active sessions, tokens, API keys, certificates, and service-principal credentials.
- Review vault logs for bulk retrieval, unusual checkout behavior, and access from unfamiliar systems.
- Reconcile the vault inventory with real infrastructure, including stale and abandoned accounts.
Protect VMware and cloud control planes
- Segment vCenter, ESXi, Horizon, and management interfaces from ordinary user networks.
- Use dedicated administrator identities and strong authentication for virtualization management.
- Alert on reactivated retired VMs, unexpected VM creation, snapshots, mounted virtual disks, template changes, virtual-network changes, and access to domain controllers.
- Monitor Entra role assignments, service-principal changes, Azure command execution, and firewall-policy deletion.
- Maintain a tenant-lockdown procedure that can disable users, service principals, roles, recovery methods, OAuth grants, and sessions.
Keep response communications outside the compromised tenant
Once Exchange Administrator access is obtained, assume that executive and security-team mailboxes may be monitored. Use an out-of-band channel for containment plans, emergency instructions, and provider escalation. Prearrange contacts with Microsoft or other cloud providers and test whether responders can act without relying on compromised corporate email or SSO.
What remains unknown
- The victim’s identity and confirmed industry. Some later reporting described a logistics firm, but the principal public account did not name the organization.
- The exact method used to obtain the original Oracle Cloud credentials.
- The full volume and precise nature of data exfiltration.
- The exact duration of each access path.
- Whether the incident formed part of a wider campaign.
- The victim’s financial, regulatory, and recovery consequences.
Those limits matter. They prevent responsible conclusions about the organization’s geography, downtime, notification obligations, or total loss.
The broader lesson
The incident was not simply a case of MFA being defeated. MFA blocked the first login; the attackers succeeded when a recovery workflow let them replace the factor. From there, excessive privilege and trust relationships connected Oracle Cloud, Entra ID, SharePoint, VMware, CyberArk, Exchange, Snowflake, VPN, and Azure into one attack chain.
For defenders, the priority is to secure the transitions between systems: help-desk recovery, privileged elevation, service-principal administration, PAM access, hypervisor management, and emergency cloud response. A strong control in one layer cannot compensate for an identity-proofing failure in the next.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
