Scattered Spider Goes to Space: The OAuth Arc Continues

The Arc

The group: Scattered Spider / Lapsus$ / "Scattered Lapsus$ Hunters" / UNC6395

The pattern: Credential theft → lateral movement → data exfiltration → extortion

The constant: OAuth tokens and legacy credentials that nobody rotated.

---

Jaguar: The £1.9B Lesson Nobody Learned

August 2025. A credential from 2021—four years old—still worked on Jaguar's Jira instance. One compromised third-party contractor account led to:

• Full IT infrastructure access
• DNS system compromise
• Vehicle infotainment systems breached
• Connected vehicle modules accessed
• Global manufacturing shutdown

Cost: £1.9 billion. UK government bailout: £1.5 billion.

The credential was four years old.

We wrote about this in October: "What Jaguar's £1.9B Cyberattack Teaches Us About Legacy Debt"

---

Salesforce: The Billion-Record Harvest

November 2025. Same group pivoted to the Salesforce ecosystem. The method:

1. Compromise third-party apps (Salesloft, Drift, Gainsight)
2. Steal OAuth tokens from support case notes
3. Access Salesforce orgs with legitimate credentials
4. Exfiltrate customer data
5. Launch extortion campaign

• Google
• Cloudflare (the $1.43B security company)
• Proofpoint (literally a security vendor)
• Adidas, Chanel, Pandora, Workday, Bugcrowd, Qantas, TransUnion, Allianz Life

Total: 1 billion records from 40 companies.

We called it in September and again in November: "UNC6395: I Told You So"

---

ESA: The Final Frontier

Now they've gone orbital.

• Attacker: "888" on BreachForums
• Haul: 200GB from Bitbucket repositories
• Contents: Source code, CI/CD pipelines, API tokens, Terraform files, hardcoded credentials

• Attacker: "Scattered Lapsus$ Hunters"
• Haul: 500GB
• Contents: Spacecraft operational procedures, contingency plans, failure modes, satellite orientation systems
• Contractors exposed: SpaceX, Airbus, Thales Alenia Space
• Entry point: Public CVE exploited in September 2025

ESA's response: "Only external servers for unclassified collaborative engineering"

Attacker's response: "We still have access"

---

The Terraform Problem

The December breach included Terraform files and hardcoded credentials. Let me explain why that matters:

• Cloud provider configurations
• Network architectures
• Service dependencies
• Often: credentials that "temporarily" got hardcoded and never removed

• How ESA's systems connect
• Where the secrets are stored
• Which services trust which other services
• Potential pivot paths to contractor systems (SpaceX, Airbus, Thales)

That's not a breach. That's reconnaissance for the next breach.

---

The OAuth Pattern

Every major Scattered Spider operation follows the same playbook:

┌─────────────────────────────────────────────────┐
│           THE SCATTERED SPIDER PLAYBOOK         │
├─────────────────────────────────────────────────┤
│                                                 │
│  1. FIND STALE CREDENTIALS                      │
│     └── Third-party contractor accounts         ��
│     └── OAuth tokens in support notes           │
│     └── Hardcoded secrets in repos              │
│     └── Credentials from years ago              │
│                                                 │
│  2. LEGITIMATE ACCESS                           │
│     └── No exploits needed                      │
│     └── Just login with valid credentials       │
│     └── Bypass MFA via session tokens           │
│                                                 │
│  3. LATERAL MOVEMENT                            │
│     └── Jira → IT infra → DNS → cars            │
│     └── Salesforce → CRM → customer data        │
│     └── Bitbucket → CI/CD → spacecraft          │
│                                                 │
│  4. EXFILTRATE & EXTORT                         │
│     └── Leak sites                              │
│     └── Ransom demands                          │
│     └── Public embarrassment                    │
│                                                 │
└─────────────────────────────────────────────────┘

No zero-days. No sophisticated exploits. Just credentials that should have been rotated years ago.

---

Why Security Vendors Keep Getting Hit

Cloudflare processes 20% of internet traffic. Got breached.

Proofpoint sells enterprise email security. Got breached.

Google has unlimited security budget. Got breached.

Why?

• Malware signatures
• DDoS patterns
• Phishing emails

• OAuth tokens pasted in support tickets
• Four-year-old contractor credentials
• Hardcoded secrets in Terraform files

Scattered Spider doesn't hack systems. They log in.

---

The Space Angle

Why does spacecraft data matter?

Operational procedures: How satellites are controlled, maintained, positioned.

Failure modes: What breaks, how it breaks, what happens when it breaks.

Contingency plans: What to do when things go wrong.

Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →

Contractor data: SpaceX, Airbus, Thales Alenia—these companies build spacecraft for governments and militaries worldwide.

• Competing space agencies
• Nation-states
• Anyone planning to interfere with space assets

Scattered Spider claims they're just criminals doing extortion. But the data they're stealing has nation-state value.

---

What We've Been Saying

September 2025: "If your secrets haven't been rotated since August, they're stale."

October 2025: "Legacy debt compounds like interest. Jaguar just paid £1.9B in accumulated interest."

November 2025: "I told you this would keep happening. It did. Rotate your damn secrets."

January 2026: They're stealing spacecraft failure modes now.

The pattern doesn't change. The altitude does.

---

Recommendations

If you're an enterprise:

1. Audit OAuth tokens NOW - Salesloft, Drift, Gainsight, HubSpot, Marketo, Zendesk
2. Search support notes for secrets - "API key", "token", "password", "secret"
3. Enforce 90-day credential rotation - No exceptions
4. Revoke third-party access quarterly - Not annually, not "when we remember"
5. Assume you're compromised - Hunt for anomalous access patterns

If you're ESA:

1. Rotate everything - The attackers claim they still have access
2. Notify contractors - SpaceX, Airbus, Thales need to know their data is out there
3. Audit Terraform state - Every secret referenced in those files is burned

---

The Timeline Receipts

The songs don't lie about when they were made. Neither do the blog posts.

---

Get Protected

All IOCs in machine-readable format:

STIX 2.1 Feed:
``bash
curl https://analytics.dugganusa.com/api/v1/stix-feed
``

OTX Profile:
https://otx.alienvault.com/user/pduggusa

Free. Timestamped. No enterprise contract required.

---

Sources

• ESA Criminal Probe - The Register
• ESA Confirms Breach - SecurityWeek
• ESA December Breach - The Register
• Salesforce Extortion - UpGuard
• UNC6395 Data Theft - Google Cloud Blog

---

About DugganUSA: We publish free threat intelligence for the 99% who can't afford enterprise security. Our STIX 2.1 feed tracks 2,200+ blocked IPs with MITRE ATT&CK attribution. We've been tracking Scattered Spider since they were earthbound.

STIX Feed | OTX Profile

---

Her name is Renee Nicole Good.

---

The cheapest, fastest, most accurate threat feed on the internet.

275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.

Look up an IOC → · Audit your brand on AIPM → · See pricing →

---

Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=scattered-spider-goes-to-space-the-oauth-arc-continues