Will
ICYMI: This is the TTP that hit the UK retailers Scattered Spider mounts a virtualized domain controller (DC)’s VMDK as a drive to a new or decommissioned VM. This effectively allows the adversary to copy the AD database ntds.dit from an unmanaged host. https://go.crowdstrike.com/rs/281-OBQ-266/images/CrowdStrike-2026-Global-Threat-Report.pdf
Will
ICYMI: Was just perusing the latest CrowdStrike 2025 Threat Hunting report (https://www.crowdstrike.com/en-us/resources/reports/threat-hunting-report/) and check this wild timeline for Scattered Spider - from account takeover to Entra ID bulk user export in <5 minutes 👀
