How an Alleged Scattered Spider was Tracked Down - #209

Federal prosecutors have charged an alleged member of the Scattered Spider cybercrime group in a case that highlights how modern cyber investigations are evolving. While the arrest itself made headlines, one detail stood out: investigators reportedly used Microsoft's Global Device ID (GDID), alongside other forensic evidence, to help connect the dots.

In this episode of Reimagining Cyber, Tyler Moffitt unpacks what makes this investigation so significant.

The conversation explores:

• Who Scattered Spider is and how the group gains initial access
• What Microsoft's Global Device ID (GDID) is and how it factored into the investigation
• Why device identity is becoming just as important as user identity
• What this case reveals about modern digital investigations
• Why VPNs don't guarantee anonymity
• The importance of logging, endpoint visibility, and identity monitoring for defenders
• Practical steps organizations can take to strengthen identity security and help desk processes

The biggest takeaway? Cybersecurity is no longer just about protecting user accounts. As attackers become more effective at impersonating people, defenders—and investigators—are increasingly relying on device identity, telemetry, and data correlation to uncover malicious activity.

If you enjoyed this episode, please rate, review, and share Reimagining Cyber. New episodes are released every Wednesday.

As featured on Million Podcasts' 

Best 100 Cybersecurity Podcasts  

Top 50 Chief Information Security Officer CISO Podcasts 

Top 70 Security Hacking Podcasts

This list is the most comprehensive ranking of Cyber Security Podcasts online and we are honoured to feature amongst the best!

Follow or subscribe to the show on your preferred podcast platform.
Share the show with others in the cybersecurity world.
Get in touch via reimaginingcyber@gmail.com