Windows is watching: Anti-piracy tool fingers Scattered Spider suspect
Summary
Microsoft's Windows Genuine Advantage Diagnostic Tool (GDID) has been used to identify a suspect linked to the Scattered Spider threat group. The tool, designed to detect counterfeit software, collects telemetry data including online activity, which proved crucial in tracing the suspect.
IFF Assessment
This is bad news for defenders as it highlights a method used by threat actors to be identified, potentially leading to their apprehension, but also reveals a telemetry collection mechanism that could be exploited or misused.
Defender Context
This incident emphasizes the importance of understanding the telemetry that operating systems collect and how it can be leveraged for investigations. Defenders should be aware of potential attribution methods that rely on software licensing checks and associated data, and how such tools might inadvertently reveal threat actor activity.