Defending Against CORDIAL SPIDER and SNARKY SPIDER with Falcon Shield

What Happened

Cybercriminals known as CORDIAL SPIDER and SNARKY SPIDER are using phone calls (vishing) to trick employees into logging into fake company portals. This affects any organization relying on Single Sign-On (SSO) and cloud-based software. It matters because the attackers steal login sessions to instantly access multiple company systems without touching traditional computers, making them very hard to catch. Organizations should monitor for unusual login locations and behaviors, and train employees to recognize fake IT support calls.

Key Takeaways

• CORDIAL SPIDER and SNARKY SPIDER are conducting high-speed, SaaS-centric data theft and extortion campaigns.
• Initial access is achieved via vishing, directing users to SSO-themed Adversary-in-the-Middle (AiTM) pages.
• Adversaries capture authentication data and session tokens to pivot directly into SSO-integrated SaaS applications via the Identity Provider (IdP).
• These attacks bypass traditional endpoint visibility by operating almost exclusively within trusted SaaS environments.

Affected Systems

• SaaS Applications
• Identity Providers (IdP)
• Single Sign-On (SSO) Systems

Attack Chain

The attack begins with vishing, where adversaries impersonate IT support to direct users to fraudulent AiTM pages mimicking corporate SSO portals. Once the user enters their credentials, the AiTM proxy captures the authentication data and active session tokens in real time. The adversaries then use these stolen tokens to access the organization's Identity Provider (IdP). Finally, they abuse the IdP trust relationship to move laterally across the victim's SaaS ecosystem for rapid data theft and extortion.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

No specific detection rules or queries are provided in the article.

Detection Engineering Assessment

EDR Visibility: Low — The article explicitly states the attacks bypass traditional endpoint visibility by operating almost exclusively within trusted SaaS environments. Network Visibility: Medium — Network logs might show connections to newly registered domains mimicking corporate SSO, but the traffic is encrypted and SaaS-to-SaaS pivoting is invisible to traditional perimeter networks. Detection Difficulty: Hard — Adversaries blend in by aligning source location, device fingerprint, and working hours, requiring advanced anomaly detection and session clustering to identify.

Required Log Sources

• IdP Authentication Logs
• SaaS Audit Logs
• SSO Sign-in Logs

Hunting Hypotheses

Hypothesis	Telemetry	ATT&CK Stage	FP Risk
Look for anomalous IdP sign-ins originating from known anonymization services or mismatched geographic locations compared to the user's typical baseline.	IdP Authentication Logs	Initial Access	Medium
Identify multiple SaaS applications being accessed in rapid succession by a single user account from a new or uncharacterized IP address.	SaaS Audit Logs	Lateral Movement	Medium

Control Gaps

• Traditional Endpoint Detection and Response (EDR)
• Standard Multi-Factor Authentication (susceptible to AiTM)

Key Behavioral Indicators

• Anomalous sign-in locations
• Use of anonymization services during authentication
• Subtle deviations in device fingerprints during SSO login

False Positive Assessment

• Medium. Anomaly detection on logins can flag legitimate travel, new devices, or VPN usage by employees.

Recommendations

Immediate Mitigation

• Review IdP logs for anomalous sign-ins or session token abuse.
• Block known AiTM domain patterns (e.g., <companyname>sso.com) at the DNS/proxy level.

Infrastructure Hardening

• Implement FIDO2/WebAuthn hardware security keys to prevent AiTM phishing.
• Restrict SaaS access using Conditional Access policies based on compliant devices and trusted IP ranges.

User Protection

• Deploy advanced identity protection tools to monitor for session hijacking and anomalous authentication flows.

Security Awareness

• Train employees on the risks of vishing and how to verify the identity of IT support personnel.
• Educate users to verify the URL of SSO portals before entering credentials.

MITRE ATT&CK Mapping

• T1566.004 - Phishing: Spearphishing Voice
• T1557 - Adversary-in-the-Middle
• T1539 - Steal Web Session Cookie
• T1078.004 - Valid Accounts: Cloud Accounts