Executive Summary
Attackers associated with the English-speaking extortion ecosystem, including Scattered Spider and 'The Com' umbrella, are increasingly utilizing sophisticated vishing campaigns targeting internal help desks and employees. By posing as IT support, threat actors leverage prior knowledge of a target's personal information to guide them through fake MFA or passkey enrollment pages. These pages either utilize Adversary-in-the-Middle (AiTM) infrastructure or serve as a distraction while the attacker registers their own authentication device.
Once access is gained, actors pivot to Microsoft Graph and SharePoint Online to conduct rapid reconnaissance and exfiltration. Reports indicate that over 100,000 files can be accessed in a single burst, often appearing as 'FileAccessed' events rather than downloads to evade traditional monitoring. The threat is characterized by the use of residential proxies and VPS hosting (notably HostPapa) to blend with legitimate user activity.
The business impact is severe, resulting in the theft of executive mailboxes and entire SharePoint libraries for extortion purposes. Affected organizations face 72-hour ransom deadlines, often accompanied by aggressive escalation tactics such as swatting and spam floods if initial demands are ignored. Defensive strategies must prioritize phishing-resistant MFA and hardened help desk verification procedures.