Scion Spider

SCION SPIDER is a Ransomware-as-a-Service (RaaS) affiliate and achieves initial access by compromising servers running Microsoft SQL Server. The adversary typically uses the built-in SQL extended procedure xp_cmdshell to run shell commands and particularly favors the Microsoft SQL Server-native sqlps utility to run PowerShell (PS) commands that download additional tooling.  SCION SPIDER frequently...