A new kind of APTs: Advanced Persistent Teenagers.
Kevin Beaumont described Transport for London dealing with a cyber incident involving a teenage actor linked to Scattered Spider-style activity and data exfil. Pattern he called out: phone the helpdesk, get MFA details reset, then steal info. Containment meant requiring tens of thousands of users into the office to reset credentials end to end. His question still lands: how's your containment plan for unknown compromised accounts?
Helpdesk social engineering beats a lot of "we have MFA" slideware. If reset flows trust a phone call more than a hard identity check, you have a process problem wearing an MFA badge.
Find this on LinkedIn and give it a thumbs up: Advanced Persistent Teenagers
Related