Scattered Spider's 2026 Playbook: Signed-Driver EDR Killers, Slack Surveillance, and a Sub-Hour Path to Domain Admin

Bring-your-own-vulnerable-driver (BYOVD) attacks work around a specific piece of Windows security architecture: driver signature enforcement, which is supposed to guarantee that anything running in kernel mode has been vetted and signed by a trusted authority. STONESTOP and POORTRY are a matched pair built to exploit that trust rather than break it outright. STONESTOP is the userland half: a loader and orchestrator that installs a driver and then issues it instructions about which processes to terminate. POORTRY is that driver, carrying a valid digital signature so Windows loads it without complaint, and once loaded it operates at kernel privilege, which is a higher trust level than almost any EDR agent runs at. From that position it can terminate the EDR's own processes before the EDR ever has a chance to flag the activity that follows.

This is not a new technique in the abstract; using a legitimately signed but exploitable driver to disable security tooling has been documented in ransomware-adjacent intrusions for several years, and BleepingComputer's own reporting has tracked POORTRY's evolution into what it describes as a full-featured EDR wiper rather than a narrow single-purpose tool. What matters for defenders tracking Scattered Spider specifically is that this class of tool is now a documented part of the group's post-access toolkit, not a one-off. A BYOVD kill happens after code execution is already achieved, which means it is not a substitute for preventing the initial foothold, it is what an attacker reaches for once that foothold exists and the next objective is making sure nothing watching the endpoint can report on what happens after. For the full mechanics of how BYOVD EDR killers work and the specific controls (Microsoft's vulnerable driver blocklist, Hypervisor-Protected Code Integrity) that stop them, see our dedicated BYOVD and EDR-killer defense guide, which covers the general defense pattern this specific tool pair fits into.

IT Pro's 2025-2026 retrospective on Scattered Spider's evolution includes a detail that is easy to read past and hard to overstate once you sit with it: the group is known to monitor communication platforms such as Microsoft Teams and Slack, impersonating compromised user accounts to facilitate further information gathering inside the target environment. The recommendation that follows from IT Pro's own reporting is direct: never share sensitive data such as passwords over these platforms, and verify identity through a video call rather than a chat message, because a chat message from a colleague's account is no longer reliable proof that the colleague sent it.

The part worth spelling out for incident responders specifically is what this means once an intrusion is already underway rather than only during initial compromise. Most organizations do not have a pre-built, out-of-band incident response communication channel sitting ready to go; when a breach is discovered, the instinct is to spin up a new channel or thread in the same Slack or Teams tenant the organization already uses every day, because that is the tool everyone already has open. If Scattered Spider has a compromised account with visibility into that tenant, an incident response channel created inside it is not a safe room, it is a window. This is an inference from the documented monitoring behavior rather than a claim that any specific responding team has been directly observed this way, but it is the reason the standard incident response guidance to move coordination to an out-of-band channel, a separate platform, a different tenant, a phone bridge, matters more against this specific actor than it does against most.

One figure that has circulated in 2025-2026 discussion of Scattered Spider intrusions is a time-to-domain-admin as short as roughly 40 minutes in an individual documented case. We were not able to independently verify a specific named primary source tying that exact number to a specific incident within the scope of this article's research, and readers should treat it as a widely repeated figure rather than a confirmed, sourced benchmark until it can be traced to a specific vendor's incident report.

What is directly verifiable is the broader shape of the trend that figure is meant to illustrate. CrowdStrike's own mid-2025 write-up on Scattered Spider's escalating activity across industries describes the group deploying Active Directory reconnaissance tooling, specifically ADExplorer and ADRecon.ps1, early in the intrusion lifecycle, alongside a toolkit built for speed: tunneling utilities and remote access software that let an operator move rather than dwell. A group that reaches for AD enumeration tooling within the same operational window as initial access, rather than treating reconnaissance as a separate, patient phase, is consistent with a privilege-escalation timeline measured in minutes to a few hours, not the multi-day-to-multi-week dwell times that characterized ransomware intrusions several years ago. Faster initial access techniques compound this further: the same MFA-fatigue and number-matching-bypass approaches covered in our MFA prompt-bombing defense guide can hand an attacker a valid, already-authenticated session in minutes, which removes one of the slowest steps from what used to be a longer chain.

The tools Scattered Spider reaches for once inside an environment have also broadened. CrowdStrike's incident reporting from the group's Q2 2025 activity, including targeting in the aviation, insurance, and retail sectors, documents a toolkit heavy on tunneling and remote access: Chisel configured to communicate through trycloudflare.com subdomains, ngrok, Pinggy, Rsocx, and Teleport for establishing covert command-and-control channels that ride on legitimate cloud infrastructure, alongside MobaXterm and S3 Browser for interacting with remote systems and cloud storage, and the abuse of legitimate remote access tools like TeamViewer and AnyDesk to blend administrative access into normal-looking traffic.

GuidePoint Security's "Worldwide Web" analysis adds a credential-theft dimension to the same picture: tooling built specifically to target privileged access management platforms, including CyberArk and Thycotic Secret Server, alongside a documented pattern of vishing calls using American-accented speakers to social-engineer password resets, and Windows registry modification scripts used for defense evasion once inside. GuidePoint's research also ties a RansomHub affiliate with prior ALPHV/BlackCat operational history to Scattered Spider activity, consistent with a group that operates as much through affiliate relationships and shared tooling as it does through a single fixed crew. None of these tools are individually new to the threat landscape; what is notable is how many of them show up together inside a single Scattered Spider intrusion chain, favoring infrastructure that rides on trusted cloud domains (Cloudflare, ngrok) specifically because that traffic pattern is harder to distinguish from legitimate business use than a custom C2 protocol would be.

Point defenses against any one of these techniques help, but the group's effectiveness comes from how the pieces stack: fast initial access, immediate visibility into the target's own response coordination, and tooling designed to disable the controls that would otherwise catch the escalation. A framework that addresses the stack looks like this.