Org2Org: Scattered Spider's Okta Impersonation
A help-desk social-engineering intrusion that abused Okta's inbound federation (Org2Org) to impersonate users across tenants. An operator phoned the IT service desk to reset a Super Administrator's MFA factors, re-enrolled the factor from an anonymizing proxy, and signed in to the Okta Admin Console as Super Admin. They granted Super Administrator to a second account for persistence, then stood up a second, attacker-controlled Identity Provider as an inbound-federation source and manipulated its username parameter to log in as real users with no victim password or MFA. Work the SIEM service-desk trail and the Okta System Log to reconstruct the chain and classify the trusted-relationship abuse.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Find the social-engineered account
35The whole intrusion starts with one help-desk request. Identify the privileged account whose MFA factors were reset off the back of a phone call.
Catch the factor re-enrollment from the attacker
35The reset created a window. Identify the external IP from which a new MFA factor was enrolled on the privileged account.
Find the second Super Administrator
35Before doing anything noisy, the attacker secured their access. Identify the account they promoted to Super Administrator.
Identify the rogue identity provider
40The impersonation needs a trusted federation source. Identify the object ID of the identity provider the attacker created.
Pin down an impersonated user
40Real employees were logged in without their knowledge. Identify one of the users authenticated through the rogue identity provider.
Classify the cross-tenant abuse
30Name the federation abuse at the heart of the impersonation. Map standing up a rogue inbound IdP to its MITRE ATT&CK technique.
7 tasks · 215 points total
Training Tools
Cloud Console
Cloud infrastructure logs
SIEM Console
Log analysis & SPL queries
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with Cloud concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allOneClik: ClickOnce + AppDomainManager Injection with ETW Patching and AWS-Hidden C2
A ClickOnce-delivered intrusion at an oil-and-gas operator that mirrors nation-state tradecraft. A spearphishing link served a Microsoft ClickOnce deployment that ran under the trusted dfsvc.exe, sideloaded a signed binary whose tampered .config used .NET AppDomainManager hijacking to load an attacker assembly at CLR startup, patched Event Tracing for Windows to blind the sensor, ran anti-debugging checks, and injected a Golang backdoor (RunnerBeacon) that hid its C2 behind AWS CloudFront and API Gateway. Reconstruct the chain from email, endpoint XDR, and cloud audit telemetry, and classify the key ATT&CK techniques.
FortiJump: FortiManager Zero-Day Config Heist
A FortiManager appliance is breached through an FGFM authentication bypass (the FortiJump zero-day): an attacker-controlled FortiManager registers itself as a trusted device, stages every managed FortiGate's configuration into a single hidden archive on the appliance, and exfiltrates it over HTTPS, stealing the fleet inventory and FortiOS256-hashed administrator passwords. Weeks later the operator re-registers and exfiltrates again to fresh infrastructure. With no malware on any firewall and no endpoint to inspect, reconstruct the entire heist from the appliance event log and perimeter firewall alone.
Shai-Hulud: Self-Replicating npm Post-Install Worm Harvesting CI/CD Secrets
A routine dependency bump on a shared Linux CI runner pulls a trojanized npm package whose postinstall hook runs a bundled worm. The worm harvests GitHub, npm, and cloud credentials from the filesystem and the Instance Metadata Service, verifies them with TruffleHog, exfiltrates the loot to a free webhook dropbox, then reuses the stolen tokens to flip private repositories public as '-migration' clones, create a public Shai-Hulud loot repository, and republish itself into the organization's own packages. Reconstruct the self-replicating supply chain compromise from endpoint XDR and egress firewall telemetry, and classify the key ATT&CK techniques.