Vulnerability Intelligence Articles

From Windows Telemetry to Arrest: How Microsoft’s GDID Helped Connect the Dots

Executive Summary The arrest and extradition of an alleged Scattered Spider member drew attention for more than the charges themselves. The most revealing detail appeared inside the court documents: Microsoft telemetry associated with a Global Device Identifier, or GDID, helped investigators connect online activity to a specific Windows installation. According to the complaint, Microsoft records ...