Rogue VM Chronicles: Forensic Reconstruction of a Scattered Spider Intrusion

Traditional endpoint detection and response (EDR) agents are powerful, but what happens when threat actors bypass them entirely by spinning up their own unmanaged systems within your hypervisor? Unit 42 investigated a complex intrusion where the notorious threat group Scattered Spider (aka Muddled Libra, UNC3944) did exactly that. After leveraging social engineering to gain administrative credentials, the threat actors accessed the victim's VMware vSphere portal, created an unmanaged rogue virtual machine, and utilized it as an operational beachhead to conduct actions on objectives. Fortunately, the security team terminated the attackers' access before they could delete the rogue VM, leaving behind a highly valuable forensic record. This presentation delivers a forensic reconstruction of Scattered Spider’s active playbook built directly from the artifacts recovered from that beachhead system. We will walk through the exact 15-hour timeline, detailing the group's living-off-the-land tradecraft and distinct troubleshooting behaviors. Attendees will learn the technical mechanics of: • Establishing persistence using an SSH tunnel hosted in an attacker-controlled AWS S3 bucket. • Disabling and powering down virtualized domain controllers via vSphere, mounting their VMDK disks, and copying the NTDS.dit database and SYSTEM registry hive to decrypt and harvest domain-wide credential hashes. • Executing Active Directory enumeration tools, and specifically targeting various computing services to map critical infrastructure. • Navigating SaaS cloud databases and attempting to exfiltrate sensitive Outlook PST files via the S3 Browser tool. We will also analyze the threat actor's real-time struggles documented in their browser history: searching Bing for how to bypass blocked file-sharing sites, troubleshooting Outlook speed issues, and researching how to find older Outlook versions on Reddit.