Hello and welcome to the Monday, June 30th,

2025 edition of the Sands Internet Storm Center's Stormcast.

My name is Johannes Ulrich, and today's episode is brought to you

by the Master's degree program in Information Security Engineering with sands.edu,

and it is recorded in Stockholm, Germany.

I want to start today with a little note about scattered spider.

This is not news by any means.

Scattered spider has been around for a while now.

It, however, keeps being around, keeps hitting the news because they use a technique that has

historically been uniquely successful, and that's social engineering.

If you remember, groups like lapses, for example, which, you know, as it later turned out,

where in no way sort of not super sophisticated nation state actors,

really just teenagers that basically conducted attacks

and were able to breach fairly well-defended organizations.

Same with Scattered Spider,

even though I haven't already seen any sort of real attribution

what Scattered Spider may sort of be all about.

But what I want to point out here is a couple things.

First off, all, Mandyant came up with a nice document to defend against Scattered Spider.

In particular, focus on some of the identity aspects here.

So better monitoring of your identity

endpoints to maybe detect some takeovers here. Also, when you're thinking about

...