[Eye Opener] Attackers Don’t Hack, They Log In. Can You Stop Them?



scattered-spider-blog-header-image-courtesy-reliaquestThe latest trend in cybercrime is that attackers don't really focus on “hacking” in; they’re logging in.

We see this now in the wild, driven by organized criminal groups like Scattered Spider and BlackCat, who’ve reemerged with a renewed focus on gaining access through legitimate means, often exploiting help desks and social engineering tactics.

Their strategies often rely on social engineering help desks to reset credentials or bypass multi-factor authentication (MFA), achieving access without breaking in. These attackers aim for the easiest route to your network, leveraging stolen credentials from info-stealers or posing as legitimate users to gain entry.

A recent case reported by ReliaQuest underscores this tactic. Scattered Spider used social engineering to trick a help desk, leading to a six-hour attack that ended in system encryption. The attackers even used Microsoft Teams to demand a ransom—showing a new level of boldness and ingenuity in modern cyberattacks.

As threat analyst Hayden Evans explains, “Attackers don’t hack in; they log in.” His advice is clear: organizations must enforce stringent help desk policies and ensure MFA configurations can withstand social engineering tricks.

To protect your network, work hard on improving employee training, monitoring for suspicious activity, and reinforcing help desk protocols. These measures build resilience against today’s advanced threat actors who bypass traditional security measures by simply logging in.


Free BreachSim Tool

How easy is it for bad actors to penetrate your system and exfiltrate your data? Pinpoint vulnerabilities, take action and build stronger cyber defenses with KnowBe4’s Breach Simulator “BreachSim.” Based on techniques outlined in the MITRE Att&CK framework, BreachSim launches 12+ simulated scenarios to uncover the stark reality of what happens when employees unknowingly fall for an attack.

BreachSim LogoHow BreachSim works:

  • 100% harmless simulation of real breach and data exfiltration attacks
  • Provides secure .txt, .doc, and .bmp test files for the simulation
  • Tests 12+ realistic data exfiltration scenarios following the MITRE Att&CK framework
  • Just download the installer, upload the secure test files, and run

Results in a few minutes!

Try Now

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/free-tools/breach-simulator



Subscribe to Our Blog


Comprehensive Anti-Phishing Guide




Get the latest about social engineering

Subscribe to CyberheistNews