SCATTERED SPIDER Exploits Windows Security Deficiencies with Bring-Your-Own-Vulnerable-Driver Tactic in Attempt to Bypass Endpoint Security

Originally published by CrowdStrike. In December 2022, CrowdStrike reported on a campaign by SCATTERED SPIDER, targeting organizations within the telecom and business process outsourcing (BPO) sectors with an end objective of gaining access to mobile carrier networks.In the weeks since that post, the CrowdStrike Falcon® platform prevented a novel attempt by SCATTERED SPIDER to deploy a malicious kernel driver through a vulnerability (CVE-2015-2291) in the Intel Ethernet diagnostics driver.The...

access business bypass campaign carrier crowdstrike crowdstrike falcon cve december driver end endpoint endpoint security exploits falcon kernel kernel driver malicious mobile mobile carrier networks novel organizations outsourcing own platform process scattered spider security tactic targeting telecom vulnerability vulnerable windows windows security