SCATTERED SPIDER Activity - Domain Controller Disk Attached to VM

Mehulkumar Savajani@Msavajani

•updated Nov 27, 2025•5•0•158

Detects the attachment of a virtual disk (.vmdk) likely belonging to a Domain Controller to another virtual machine. This technique is used by threat actors like SCATTERED SPIDER to access the Active Directory database (ntds.dit) for offline credential dumping. This is often done on a newly created, attacker-controlled VM.