This week, CISA updated its advisory on Scattered Spider. Scattered Spider is a threat actor using social engineering tricks to access target networks. The techniques used by Scattered Spider replicate those used by other successful actors, such as Lapsus$. Social engineering does not require a lot of technical tools; creativity is key, and defenses have a hard time keeping up with the techniques used by these threat actors. For this diary, I want to "zoom in" on one update noted in this week's CISA report. CISA noted that Scattered Spider is using the following domain name patterns: targetsname-cms[.]com targetsname-helpdesk[.]com oktalogin-targetcompany[.]com Using our "recent domain" API, we can run a quick check on some of these. Let's start by getting the latest (yesterday's)…