The request looked routine. That was the attack.
A 2025 joint CISA and FBI advisory on the Scattered Spider group described targeted approaches prepared through open-source and commercial reconnaissance. This second of two threat-doctrine briefs, following CB-105, asks why a request built that way reads as routine to a careful recipient, and how exposure-reduction work against it should be measured. Built from the advisory and deception-detection research, and kept at the defensive level. For those responsible for a principal's protection and for evaluating removal programs.
Unlock this Command Brief.
Get this assessment, the full subscription collection, and new intelligence as it is published.
For your first year, then $100/month. Or $750 for the first year, then $1,000 annually.
- The CORGI Morning Brief, each morning
- This brief and the subscription collection, 100+ briefs
- New Command Briefs as they are released
- Principal and Analyst briefs, as PDF
Secure checkout through Substack. Substack asks for your email first.