Inside Scattered Spider: A Red vs. Blue Breach & Attack Simulation

No ratings

Presented at BSides Tallinn 2026 by

Marvin Ngoma

Scattered Spider redefined modern ransomware operations through sophisticated social engineering, privilege escalation, and rapid domain-wide compromise. In this immersive workshop, participants experience the attack from both perspectives: first as the attacker, then as the defender. Working through a realistic breach simulation, you'll execute key phases of the attack before switching roles to detect, investigate, and respond using modern detection and endpoint security capabilities. By the end of the workshop, you'll understand not only how the attack works, but why defenders succeed, or fail, at each stage. You'll learn: How Scattered Spider gains initial access and escalates privileges. How to detect and investigate each stage of the attack. Where traditional defenses fall short. How modern security operations and AI-assisted investigation can reduce time to detection and response.