Court Filing Reveals Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker

Attackers exploited the human element by using social engineering to manipulate help desk staff into resetting employee credentials, bypassing technical controls entirely and gaining administrative access. Once inside, 77GB of sensitive data was exfiltrated before a ransom demand was issued — a classic ransomware playbook enabled by insufficient identity verification procedures. Ironically, the attacker was caught because Microsoft's persistent Windows Global Device Identifier created an immutable digital trail linking the intrusion device to the suspect's online accounts. This case underscores that strong perimeter defenses mean little if help desk processes can be manipulated to hand over the keys, and that persistent device telemetry can be a powerful forensic asset for investigators.