https://www.tomshardware.com/software/windows-11-identifier-used-to-track-scattered-spider-perp-after-microsoft-shared-info-with-fbi-19-year-old-us-estonian-hacker-arrested-over-alleged-ties-to-infamous-extortion-group

It's always the telemetry you most suspect

@sharkfie the big question I have here (and which I couldnt find docs on during a cursory search) which none of this reporting mentions is how/when/where the device ID is collected?

Like, sure, a device ID is a thing, who cares. Where the fuck is the Activity<->ID link collected??

@nyanbinary https://www.justice.gov/usao-ndil/media/1450651/dl?inline [pdf] pages 8 and 38

I only skimmed it, but seems like a name for several identifiers meant to identify a machine across reinstalls (like for activation). Some sort of HWID?

@nyanbinary I mean, clearly doing more than licensing. But just the most well known use.

@sharkfie ok, but like, the question still is: Who/how is this linkage connected.

Lets take 26. as an example:

According to Microsoft records, on or about May 12, 2025, at 19:21 UTC—when, according to ngrok records, the ngrok account was created—the device with the GDID accessed, among other ngrok pages, “https://dashboard.ngrok.com/signup,” the ngrok page to set up an ngrok account.

ngrok isn't MS & afaik isn't even Azure-hosted. I'm trying to look for a way that MS still would be able to know about the page visit for the device ID without just pulling non-anonymized browsing data from device, lmao.