Threat Actors Targeting SaaS and Cloud Identity Guide: Who They Are and How to Stop Them

The groups doing the most damage to SaaS and cloud estates rarely need malware on an endpoint: they log in, with a password, a session, an OAuth token or a service account they have talked, sprayed or stolen their way into. This guide compares six actors whose primary vector is identity: Scattered Spider, ShinyHunters, Storm-0501, APT29 (Midnight Blizzard), APT33 (Peach Sandstorm) and TeamPCP. It sets out what each one targets, the human and non-human identity techniques they share, the persistence they plant in the identity plane, and which controls and detections break the most of them at once. It is for identity, cloud security and SOC leads deciding where to spend effort; it builds on the Top 10 Identity Attacks, which covers the techniques, and links each actor's full profile.

Key takeaways

• Six actors, three entry points. Talking a person or help desk into credentials (Scattered Spider, ShinyHunters), guessing passwords at scale (APT29, APT33), and stealing machine credentials such as OAuth, sync and pipeline tokens (Storm-0501, TeamPCP, APT29, UNC6395 in the Salesloft Drift case).
• Non-human identities are the force multiplier. A legacy OAuth app gave Midnight Blizzard mailbox-wide access; an Entra Connect sync account and a synced admin account without MFA took Storm-0501 into Azure; registry tokens let TeamPCP publish to other projects.
• Persistence lives in the identity provider. Attacker MFA devices, federated domains, new OAuth apps and cloud role assignments survive password resets. Eviction means auditing those, not just resetting accounts.
• Phishing-resistant MFA is necessary, not sufficient. It defeats spraying, prompt bombing and fake portals, but not a help desk that re-enrols an attacker, a user who authorises a malicious connected app, or a stolen token.
• Detection is about identity changes. New authenticators, federation and Conditional Access edits, app consents and bulk SaaS exports are the signals all six actors trip; network indicators are weak because most use residential proxies, VPNs or Tor.

Why identity-first actors are different

Classic intrusion detection looks for malicious binaries, command and control and lateral movement over SMB. These actors produce little of that in the cloud phase. Microsoft describes Storm-0501's 2025 operation as cloud-based ransomware that does not rely on traditional malware deployment; Google describes ShinyHunters-branded data theft as "not a vulnerability in vendors' products" but effective social engineering. The activity is a valid identity calling legitimate APIs: Salesforce Data Loader, Exchange Web Services, Azure Resource Manager, the npm registry.

Three consequences follow. Logs that matter live in the identity provider and SaaS audit trails, not EDR. IP reputation helps little: the joint NCSC and partner advisory on SVR cloud access notes residential proxies make IP indicators less useful, and Google warns that many ShinyHunters-related indicators are commercial VPN or residential proxy addresses. And the blast radius of one identity is set by its entitlements, so least privilege for service accounts and apps is a detection control as much as a preventive one.

The actors at a glance

Names overlap and change: Google's UNC clusters, Microsoft's weather names and MITRE's groups do not map one to one. See the Threat Actor Naming Conventions Guide.

Entry through human identities

Voice and help desk social engineering

Scattered Spider calls the help desk as an employee to get passwords and MFA reset; MITRE records help desk staff being compelled to reset both (T1684.001). ShinyHunters calls the employee instead. Google's 2025 report describes UNC6040 operators posing as IT support and talking victims into entering a "connection code" on Salesforce's connected app setup page, which authorised a modified Data Loader app; some apps were named "My Ticket Portal" to fit the pretext. Google's January 2026 report describes UNC6661 claiming the company was updating MFA settings, sending victims to domains such as <companyname>sso.com, then registering the attacker's own MFA device. MITRE also records ShinyHunters using an AI voice service to script calls (T1588.007). See the Account Recovery and Help Desk Security Guide and the Vishing and Smishing Guide.

Password spraying

Microsoft reports Peach Sandstorm spraying thousands of organisations from February to July 2023, consistently from Tor IPs with the go-http-client user agent, and in late May and June almost entirely between 9:00 and 17:00 Iran Standard Time. Midnight Blizzard sprayed a "legacy, non-production test tenant account" without MFA in late 2023, using few attempts per account and residential proxies. The joint advisory on SVR cloud access says the actor sprays service accounts precisely because they lack a human user and are hard to protect with MFA. See the Password Spraying and Credential Stuffing Defence Guide.

MFA fatigue and session theft

APT29 and Scattered Spider both send repeated MFA requests (T1621), and Scattered Spider steals browser cookies (T1539). Infostealer logs feed the same market: the Snowflake Breach 2024 shows an extortion group (UNC5537) using infostealer credentials against about 165 customer accounts that lacked MFA. See the MFA Fatigue and Bypass Guide and the Infostealer Logs and Session Token Abuse Guide.

Entry and escalation through non-human identities

Every row is an identity with no human to notice a strange prompt, often with standing privilege and no owner. See the Service Account Security Guide, the SaaS and OAuth App Governance Guide and the Microsoft Entra Connect and Cloud Sync Hardening Guide.

Persistence in the identity plane

These are the changes to hunt for after any of the entries above, and the ones incident responders most often miss.

Google records UNC6661 deleting the "Security method enrolled" notification email in Okta incidents, so the user will not report the new device for you. See the Federation and Trust Relationships Guide and the OAuth Token Theft Incident Playbook.

Controls that break the most actors

The NCSC-led advisory also recommends canary service accounts that legitimate services never use, with urgent alerts on any sign-in: a cheap control against spraying of service accounts.

Detection and measurement

• Identity changes after a reset: correlate help desk tickets with password reset and MFA registration within minutes.
• Spray patterns: many accounts, few attempts each, from Tor, VPN or proxy ranges; Microsoft lists Entra ID Protection "Password spray" and "Unfamiliar sign-in properties" detections, and Defender for Cloud Apps "Activity from a password-spray associated IP address".
• Workload identity sign-ins: Entra ID Protection's suspicious workload identity sign-ins and sync account use from anywhere but the sync server.
• Bulk SaaS export: Salesforce Event Monitoring and Transaction Security Policies for large downloads (Google); SharePoint high-volume download and PowerShell bulk access (Google's detection rule names); Exchange MailItemsAccessed spikes by application-only apps (Microsoft).
• Session anomalies: the NCSC-led advisory favours user-agent changes over IP reputation as a sign of session hijacking.

Metrics:

• Percentage of privileged accounts using phishing-resistant MFA only (target 100%).
• Non-human identities with a named owner and last-used date (target 100%); dormant or test accounts with sign-in enabled (target zero).
• Third-party OAuth apps and connected apps not on the allowlist (target zero).
• Median time from authenticator registration, federation change or app consent on a privileged identity to analyst review.
• Pretext call success rate in authorised help desk and user vishing tests.
• Time to revoke every token for one compromised integration, measured in exercises.

Correlation across IdP, SaaS and cloud logs is ITDR's job. See the ITDR Guide.

How to prioritise and roll out

Choosing what matters to you: if you run a large outsourced service desk or are in retail, hospitality or telecoms, Scattered Spider's playbook comes first. If your crown jewels sit in Salesforce, Workspace or Microsoft 365, ShinyHunters' connected app and SSO vishing comes first. Hybrid Microsoft estates with sync servers should start with Storm-0501. Government, defence, satellite and policy organisations face APT29 and Peach Sandstorm spraying. Anyone publishing software or running CI/CD with cloud credentials faces TeamPCP.

Small vs large: a small organisation with one IdP and a few SaaS apps gets most value from phishing-resistant MFA, an app allowlist and removal of unused accounts, which can be done in a month. Large organisations add help desk process change across providers, an NHI inventory, ITDR correlation and Tier 0 separation.

1. Weeks 1 to 2: inventory admin, service, test and integration identities; disable dormant and test accounts after a two-week notice; confirm two cloud-only break-glass accounts work before any policy change.
2. Weeks 2 to 6: change the help desk procedure for privileged resets; enforce phishing-resistant MFA for admins; block legacy authentication in report-only mode first, then enforce.
3. Weeks 4 to 8: OAuth and connected app allowlists in audit mode, review hits with app owners, then enforce; restrict device enrolment.
4. Weeks 6 to 12: alerts on the persistence table above; canary service accounts; bulk export monitoring in the main SaaS platforms.
5. Rollback and test: keep every Conditional Access change in report-only for a week with a named rollback owner; run authorised vishing tests and an eviction tabletop that checks every persistence type.

Common failure patterns

• Forgotten test and legacy identities: the Microsoft Midnight Blizzard Breach started with a test tenant account without MFA and a legacy OAuth app with elevated access.
• Letting users authorise apps: the ShinyHunters Salesforce Data Theft Campaign 2025 needed only a user willing to enter a code on the connected app page.
• Trusting integration tokens indefinitely: the Salesloft Drift Breach 2025 turned one vendor's tokens into access at hundreds of customers.
• Synced, privileged machine accounts: the Storm-0501 Hybrid Cloud Attacks 2024 crossed from AD to Entra ID through sync credentials.
• Password reset as eviction: MFA devices, federation, apps and roles survive it. The NCSC-led advisory notes SVR actors regaining access via inactive accounts after enforced resets.
• Blocking IPs instead of hunting behaviour: residential proxies and VPNs make the blocklist a moving target.

Lessons from incidents

The MGM Resorts Breach 2023 and the Trivy Supply Chain Attack 2026 look unrelated: one a phone call to a help desk, the other a stolen bot token. Both end the same way, with an attacker holding a legitimate identity whose entitlements nobody had sized for misuse, and both were prolonged by persistence or credentials that survived the first response. The common lesson across all six actors is to inventory what each identity can reach, make it re-prove itself with something that cannot be phished or replayed, and treat identity-plane changes as security events.

Framework mapping

Practitioner checklist

• Map which of the six actors fits your sector and estate, and read their profiles first.
• Move all administrators, then all users, to phishing-resistant MFA.
• Require call-back and a second approver for privileged password and MFA resets, including at outsourced help desks.
• Allowlist OAuth and connected apps and restrict who can authorise them.
• Inventory non-human identities with owners; disable dormant, test and orphaned accounts and apps.
• Block legacy authentication and restrict device enrolment to authorised devices.
• Alert on MFA registration, federation, Conditional Access, app consent and cloud role changes.
• Monitor bulk exports in Salesforce, Microsoft 365 and Workspace, and deploy canary service accounts.
• Rehearse eviction covering every persistence type, not just password resets.

Standards and references

• MITRE ATT&CK: Groups (G1015, G1057, G1053, G0016, G0064, G1056)
• NCSC, CISA and partners: SVR cyber actors adapt tactics for initial cloud access (AA24-057A)
• Microsoft: Midnight Blizzard, guidance for responders on nation-state attack
• Microsoft: Peach Sandstorm password spray campaigns enable intelligence collection at high-value targets
• Microsoft: Storm-0501's evolving techniques lead to cloud-based ransomware
• Google Threat Intelligence Group: The Cost of a Call, from voice phishing to data extortion
• Google Threat Intelligence Group: Tracking the expansion of ShinyHunters-branded SaaS data theft
• FBI: FLASH-20260702-01 TeamPCP

Related NHI Mgmt Group resources: Top 10 Identity Attacks · Identity Provider and SSO Security Guide · Okta Security Hardening Guide · Salesforce Security Guide · Microsoft 365 Security Guide