Scattered Spider, Starfraud, UNC3944, Scatter Swine, and Muddled Libra

[ramimac]

https://www.cisa.gov/sites/default/files/2023-11/aa23-320a_scattered_spider_0.pdf

Threat actors activate Amazon Web Services (AWS) Systems Manager Inventory [T1538] to discover targets for lateral movement [TA0007],[TA0008], then move to both preexisting [T1021.007] and actor-created [T1578.002] Amazon Elastic Compute Cloud (EC2) instances

Previously in:

• https://web.archive.org/web/20230316062338/https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies
• https://www.reliaquest.com/blog/scattered-spider-attack-analysis-account-compromise/

Addresses #125