Updated October 18, 2026. I've made some edits since this was first published. Every change is listed in the changelog at the bottom. Also, since this was written, CISA has updated its Scattered Spider advisory (July 2025) and there have been arrests and charges tied to the group, so check the latest reporting before you lean on this for current TTPs.
A fundamental skill in Cyber Threat Intelligence is mapping intrusions. There are several ways to portray such complicated events, each with various pros and cons. In this post, we’ll discuss the Diamond Model and use it to map Scattered Spider’s intrusion of MGM Resorts.
Some Diamond Model Background
Every intrusion event includes an adversary moving toward an objective by using a capability over infrastructure against a target. Those events can be chained into activity threads (sequence of steps) and clustered into activity groups (campaigns). For this mapping, we will be using one Diamond to map the entire intrusion. In a future post, we will look at creating more specific Diamonds for each intrusion event.
The Diamond Model is “…purposefully generic and thereby expandable and flexible. It accurately captures the essential concepts of intrusion analysis and adversary operations. These attributes enhance the model’s utility, allowing it to grow and encompass new ideas and concepts.”(1)
Diamond model of intrusion analysis
That expand-ability and flexibility make the Diamond Model a great framework when an intrusion or incident is moving quickly. It provides 4 buckets to organize indicators or behaviors of suspicious nature. Such broad categories can also cause confusion if there are multiple phases that utilize different or contradictory tradecraft. The Diamond Model does have the ability to scale up and down in technicality depending on what the analyst needs, as referenced above.
A brief example of a fast moving intrusion where a broader Diamond Model implementation may be useful could look like a phishing email. You as an analyst can add “phishing” as a capability. You can add the recipient address under “Target,” and the sender under “Adversary.” The IP address for the sender would go under “Infrastructure.” (Be careful about using where that IP geolocates to say anything about the Adversary. VPNs and rented servers make that a really weak signal.) Your intrusion mapping is already starting to take shape!
The Diamond Model’s shape plays an important role in showing synergies between the endpoints. Each side represents a relationship.
These relationships are what help drive analytical pivoting. Knowing how the vertices interact allows an analyst to utilize the relationships to discover new knowledge of malicious activity.
The phishing example above demonstrates pivoting: The adversary developed the phishing email, exploiting the target. We used logs to find the IP infrastructure the adversary used to connect to the target. The source of that IP can be adversary related or further intel on the infrastructure architecture.
Lastly, when you get stuck and can’t find a way to move forward in the investigation, you can use each point (as well as “social-political” and “technology”) to be the lens through which you pivot. This is the practice of saying “I know this fact about the [insert pivot point]. What else can I gather from that fact?” For example, Infrastructure-centered pivoting may start with a known malicious domain. From there, an analyst can look at the DNS/WHOIS data, find related domains, and possibly link them to other malware campaigns.
MGM Intrusion Mapping
The MGM intrusion made a ton of headlines in September 2023. According to the attackers (relayed by vx-underground), it took about 10 minutes on the phone with MGM’s help desk to get in.(2) Gleaning from what is publicly known, it seems that the outage was a combination of MGM’s defensive measures to shut down Okta sync servers, network domains, etc. as well as the ransomware deployed by the attackers.
Big caveat before we start: MGM never put out a detailed incident report, so a lot of the technical detail below comes straight from ALPHV’s own statement.(3) And attackers LOVE to exaggerate lol so I marked those parts as claimed.
Adversary
Two names show up here and people mix them up ALL the time, so let’s untangle it.
- Scattered Spider (also tracked as UNC3944, Octo Tempest, Muddled Libra, and Oktapus) is the group that did the hands-on-keyboard intrusion. A lot of them are native English speakers, which is a big reason their phone calls are so convincing.(4, 5)
- ALPHV/BlackCat is the ransomware-as-a-service operation. Microsoft reported that Scattered Spider became an ALPHV affiliate in mid-2023, which gave them ALPHV’s ransomware to deploy.(4)
ALPHV posted a public statement taking credit and “correcting” news coverage, and said one of its affiliates was behind it.(3) Bloomberg, Reuters, and others named Scattered Spider. So BOTH go on the Adversary vertex: Scattered Spider doing the break-in and ALPHV supplying the ransomware.
Infrastructure
Quick nerdy framework note: the Diamond Model splits infrastructure into Type 1 (owned or controlled by the adversary, like their phones or servers) and Type 2 (controlled by someone else, like compromised systems, that the adversary uses as a go-between).(1) Most of what’s public about MGM is Type 2: MGM’s own systems, turned against it. Very little of the attackers’ own (Type 1) infrastructure for this intrusion has been made public. That’s a gap, and gaps go in the report too!
Type 1: phones. The attackers called MGM’s help desk while pretending to be an MGM employee.(2) We don’t know what numbers or services they called from, but Scattered Spider is known for this approach. CISA’s advisory describes them posing as IT or help desk staff over phone and SMS to get credentials and MFA resets.(5)
Type 2: MGM’s identity and virtualization stack (claimed). According to ALPHV, the attackers got super-administrator privileges in MGM’s Okta tenant and Global Administrator rights in its Azure tenant.(3) They also claimed they kept those rights even after MGM took its Okta sync servers offline. With that level of identity access, they could reach the systems that manage MGM’s ESXi hypervisors.
Recon source: LinkedIn. LinkedIn wasn’t used to deliver anything. It was where they reportedly found the employee to impersonate.(2) I’d call it a recon resource more than true infrastructure, but I still like having it on the diamond since it’s where the whole thing started.
Capability
- Vishing the help desk. The initial access.(2) We could hypothesize that the attackers knew MGM’s process for over-the-phone credential help was easier to exploit than other ways in. Or it could just be that phone social engineering is their strong suit. Whatever the reason, it worked.
- Identity abuse. Using Okta and Azure admin rights to move around and keep access.(3)
- Credential harvesting (claimed). ALPHV said they sniffed passwords off MGM’s Okta agent servers, for example to get passwords they couldn’t crack from domain controller hash dumps.(3)
- Ransomware. ALPHV/BlackCat’s ESXi encryptor. ALPHV claimed it was launched against more than 100 ESXi hypervisors on September 11.(3) Those hosts ran the virtual machines behind many of MGM’s hospitality systems: slot machines, digital room keys, reservation systems, websites, etc. Encrypting them is what made those systems stop working.
Target
MGM Resorts as well as Caesars were targets of this campaign. Caesars disclosed its own breach in an SEC filing, and the Wall Street Journal and Bloomberg reported that Caesars paid around $15 million of a $30 million ransom demand. Caesars didn’t report the kind of operational outage MGM had.(6)
MGM told the SEC it expected the attack to cut about $100 million from its Las Vegas Strip and regional properties’ Adjusted Property EBITDAR, mostly in Q3 2023, plus less than $10 million in one-time costs for consultants, legal fees, and the like.(7)
If you use the traditional word for this vertex, “Victim,” there were other proxy victims. The employee that had their identity stolen likely had to rotate credentials, get a new badge and ID number, and figure out how and where the attackers got their information. MGM’s customers were victims too, since customer data was stolen.(7)
Conclusion
The Diamond Model doesn’t just help us document what happened during an intrusion, it gives us a framework to think critically about how adversaries operate, why they succeed, and where defenders can intervene. Mapping Scattered Spider’s attack on MGM Resorts shows how quickly social engineering, identity infrastructure, and ransomware can converge into a major business outage. By applying structured models like the Diamond, CTI analysts can turn chaos into clarity, identify defensive opportunities, and ultimately make future intrusions less costly and disruptive.
Sources
-
Caltagirone, S., Pendergast, A., & Betz, C. (2013). The Diamond Model of Intrusion Analysis. Center for Cyber Intelligence Analysis and Threat Research. Retrieved from https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf
-
Gizmodo. (2023, September 13). MGM Grand cyberattack caused by 10-minute phone call (relaying vx-underground's report of the attackers' claims). Retrieved from https://gizmodo.com/mgm-grand-cyberattack-caused-by-10-minute-phone-call-1850834558
-
BleepingComputer. (2023, September 14). MGM casino's ESXi servers allegedly encrypted in ransomware attack. Retrieved from https://www.bleepingcomputer.com/news/security/mgm-casinos-esxi-servers-allegedly-encrypted-in-ransomware-attack/
-
Microsoft Threat Intelligence. (2023, October 25). Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction. Retrieved from https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/
-
CISA & FBI. (2023, November 16; updated 2025, July 29). AA23-320A: Scattered Spider. Retrieved from https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
-
BleepingComputer. (2023, September 14). Caesars Entertainment confirms ransom payment, customer data theft. Retrieved from https://www.bleepingcomputer.com/news/security/caesars-entertainment-confirms-ransom-payment-customer-data-theft/
-
MGM Resorts International. (2023, October 5). Form 8-K. Retrieved from https://www.sec.gov/Archives/edgar/data/789570/000119312523251667/d461062d8k.htm
Changelog
- October 18, 2026:
- Added sources for the MGM-specific details. The original version only cited the Diamond Model paper.
- Labeled the details that come from ALPHV's own statement as claimed.
- Rewrote the Adversary section to explain how Scattered Spider and ALPHV/BlackCat fit together (affiliate and ransomware-as-a-service operation).
- Added an explanation of Type 1 and Type 2 infrastructure and reorganized the Infrastructure section around it. LinkedIn is now called a recon resource instead of infrastructure.
- Added a Capability section, which the original was missing.
- Changed the MGM financial impact to match MGM's SEC filing: about $100 million off Adjusted Property EBITDAR, plus less than $10 million in one-time costs. The original said "$100 million dollars lost."
- Added a source for Caesars' reported ransom payment.
- Removed a guess that the help desk employee may have lost their job, since I had no source for it.
- Added a caution about using IP geolocation to say anything about the adversary in the phishing example.
- Fixed typos, and changed the one superscript citation to the (1) style used by the rest of the post.
- September 21, 2025: Published.