# Unit 42: Identity Compromise Is the Primary Attack Vector in Nearly 90% of Incidents

> Unit 42's 'Inside the Modern SOC: The Identity Front Door' report finds identity weaknesses played a role in nearly 90% of investigated incidents, with 65% of initial access activity involving identity-based techniques and 87% of incidents spanning multiple attack surfaces. The report cites Muddled Libra (Scattered Spider) as the exemplar of identity-abuse tradecraft: help-desk impersonation, MFA fatigue/bypass, and social engineering to defeat traditional perimeter controls.

- **Published:** 2026-08-08T00:00:00Z
- **Last reviewed:** 2026-08-08T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1938
- **ID:** TL-2026-1938
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Scattered Spider
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Palo Alto Networks Unit 42 published 'Inside the Modern SOC: The Identity Front Door' on 2026-08-07 (author Sharon Maydar), synthesizing incident-response findings across Unit 42's investigated caseload. The headline findings: identity weaknesses factored into roughly 90% of incidents investigated; 65% of initial-access activity specifically involved identity-based techniques (credential theft, MFA manipulation, session hijacking, and social engineering); and 87% of incidents spanned multiple attack surfaces (endpoint, cloud, SaaS, and network) rather than staying contained to a single domain. Unit 42 describes a repeatable attack progression: initial identity compromise, followed by persistence and account expansion, privilege escalation, multi-domain lateral movement, and finally objective achievement — ransomware deployment, data theft, financial fraud, or long-term persistent access.

The report cites Muddled Libra (publicly tracked as Scattered Spider, UNC3944, Octo Tempest, and Storm-0875) as the clearest example of this identity-first tradecraft. Muddled Libra is a native-English-speaking, financially motivated cybercrime group active since at least 2022. Rather than exploiting software vulnerabilities, the group's signature technique is social-engineering help-desk and IT-support staff by phone or SMS: callers impersonate a locked-out employee, pressure the agent into resetting the target's password and/or MFA method, and then enroll an attacker-controlled device for future MFA approvals. Where help-desk impersonation is not viable, the group instead floods a target with repeated MFA push notifications ('MFA fatigue' / MFA bombing) until the victim approves one out of frustration. Unit 42 has documented cases where this chain took the group from initial contact to domain administrator rights in under 40 minutes without deploying any malware.

Muddled Libra emerged from the 0oktapus/0ktapus phishing-kit ecosystem in 2022, initially targeting CRM, business-process-outsourcing (BPO), and telecommunications firms before expanding in 2023 into gaming, hospitality, retail, MSP, manufacturing, and financial-services targets. In 2023 the group joined the ALPHV/BlackCat ransomware-as-a-service affiliate program; a joint CISA/FBI advisory (AA23-320A) was first issued 2023-11-16 and substantially updated 2025-07-29 to document new tradecraft including DragonForce ransomware deployment and Snowflake cloud-database targeting. After a lull in late 2024, the group resumed operations in 2025 with expanded hybrid-cloud and identity-platform tradecraft, using help-desk impersonation and MFA bypass to obtain administrative access to Okta, AWS, and Microsoft 365/Entra ID tenants.

Unit 42's remediation guidance centers on identity-aware detection engineering rather than patching: correlating identity/authentication telemetry with endpoint, cloud, SaaS, and network telemetry for behavioral context; consolidating that telemetry into a unified investigative platform (Unit 42 references its own Cortex XSIAM); continuously refining detections, correlation rules, and response playbooks for identity-based attack chains; and dedicating resources to proactive threat hunting for credential-abuse patterns specifically (e.g., anomalous MFA re-enrollment, help-desk reset volume, impossible-travel logins).

## MITRE ATT&CK

- T1589.001 Credentials
- T1566.004 Spearphishing Voice
- T1078.004 Cloud Accounts
- T1098.005 Device Registration
- T1136 Create Account
- T1556.006 Multi-Factor Authentication
- T1098.003 Additional Cloud Roles
- T1564.008 Email Hiding Rules
- T1621 Multi-Factor Authentication Request Generation
- T1539 Steal Web Session Cookie
- T1003.006 DCSync
- T1087.004 Cloud Account
- T1069.003 Cloud Groups
- T1021.001 Remote Desktop Protocol
- T1114.003 Email Forwarding Rule
- T1567.002 Exfiltration to Cloud Storage
- T1657 Financial Theft

## Sources

- [Inside the Modern SOC: The Identity Front Door](https://unit42.paloaltonetworks.com/soc-identity-front-door/)
- [#StopRansomware: Scattered Spider (AA23-320A, updated)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a)
- [Scattered Spider Cybersecurity Advisory AA23-320A (original PDF)](https://www.cisa.gov/sites/default/files/2023-11/aa23-320a_scattered_spider_0.pdf)
- [Scattered Spider, Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944 (Group G1015)](https://attack.mitre.org/groups/G1015/)
- [Threat Group Assessment: Muddled Libra (Updated May 16, 2025)](https://unit42.paloaltonetworks.com/threat-group-assessment-muddled-libra-2024/)
- [Cybersecurity Alert - FINRA Notifies Members of Joint CISA & FBI Cybersecurity Advisory (AA23-320A)](https://www.finra.org/rules-guidance/guidance/cybersecurity-alert-finra-notifies-member-firms-of-joint-cisa-fbi-advisory-111723)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1938