Scattered Spider
Financially Motivated Social Engineering Collective Targeting Enterprise Identity Systems
Scattered Spider is one of the most successful financially motivated threat actors of the 2020s, distinguished by sophisticated social engineering enabled by native English fluency. The group has caused hundreds of millions of dollars in damages through data theft, extortion, and ransomware deployment, including the devastating MGM Resorts attack.
Download Full Threat Actor Profile
Complete intelligence report including detailed TTPs, MITRE ATT&CK mapping, IOCs, detection rules, and defensive recommendations.
Download PDF — FreeReport ID: INT-TAP-2025-SCATTERED-SPIDER • TLP:CLEAR
Attribution & Identity
Attribution Assessment
Scattered Spider is a loosely organized, financially motivated threat collective composed primarily of native English-speaking individuals aged 19-22 from the United States and United Kingdom. Multiple members have been arrested and indicted since 2024, confirming law enforcement attribution.
Background
Scattered Spider is one of the most successful financially motivated threat actors of the 2020s, distinguished by their sophisticated social engineering capabilities enabled by native English fluency. The group has caused hundreds of millions of dollars in damages through data theft, extortion, and ransomware deployment.
The group targets enterprise identity providers (Okta, Entra ID) and help desks using phone calls, SMS phishing, and MFA fatigue attacks. Once inside, they rapidly escalate privileges, exfiltrate data, and deploy ransomware through partnerships with various RaaS operations.
In 2025, Scattered Spider partnered with the DragonForce ransomware cartel, leading to high-profile attacks against Marks & Spencer, Co-op, and Harrods. Reports indicate an emerging "cartelization" of cybercrime, with Scattered Spider, LAPSUS$, and ShinyHunters forming collaborative channels.
Law Enforcement Action
Despite multiple arrests, Scattered Spider activity continues. The loose collective structure allows remaining members to continue attacks and recruit new operators.
| Date | Individual | Location | Details |
|---|---|---|---|
| Jan 2024 | Noah Urban ("Sosa") | Florida, USA | Cryptocurrency theft charges |
| Jun 2024 | Tyler Buchanan ("TylerB") | Spain | $27M Bitcoin seized |
| Jul 2024 | 17-year-old | UK West Midlands | Undisclosed charges |
| Nov 2024 | 5 individuals | Various | Federal indictments |
| Dec 2024 | Remington Ogletree | Texas, USA | Fraud charges |
Targeting Profile
Scattered Spider has evolved from targeting telecommunications and BPO firms to high-value enterprises across multiple sectors, with a focus on organizations with valuable data and cyber insurance.
Target Sectors
Target Technologies
| Category | Specific Targets |
|---|---|
| Identity Providers | Okta, Microsoft Entra ID (Azure AD) |
| Help Desk Systems | ServiceNow, Zendesk, internal IT support |
| Remote Access | VPN, Citrix, RDP |
| Virtualization | VMware vCenter, ESXi |
| Cloud Platforms | AWS, Azure, GCP, Snowflake |
| Collaboration | Slack, Microsoft Teams |
Scattered Spider operators actively monitor Slack and Microsoft Teams channels for detection. They have been observed joining incident response calls to gather intelligence on defender activities.
Tactics, Techniques & Procedures
Scattered Spider employs a sophisticated attack methodology that combines social engineering with technical exploitation. Their MITRE ATT&CK mapping (G1015) includes the following key techniques:
Signature Tradecraft: Social Engineering
Scattered Spider's primary differentiator is their exceptional social engineering capability, enabled by native English fluency and deep knowledge of enterprise IT processes.
Ransomware Affiliations
Scattered Spider operates as an affiliate for multiple Ransomware-as-a-Service (RaaS) operations, receiving approximately 80% of ransom payments while the RaaS provider handles infrastructure.
DragonForce offers a white-label "RansomBay" service allowing affiliates to rebrand ransomware. Affiliates keep 80% of ransoms while DragonForce handles infrastructure, leak sites, and technical support.
Notable Incidents
A 10-minute phone call to the IT help desk led to full domain compromise. Slot machines, hotel check-in, and booking systems were disabled for 36 hours. BlackCat ransomware was deployed.
Social engineering attack compromised loyalty program member data. Caesars paid approximately $15 million ransom to prevent data leak.
DragonForce ransomware deployment via Scattered Spider initial access. Major UK retailer suffered significant operational disruption and stock price decline.
Part of the coordinated UK retail targeting campaign using DragonForce ransomware. Both organizations confirmed cyberattacks affecting operations.
Detection & Response
Detection Opportunities
Defensive Recommendations
- Deploy Phishing-Resistant MFA — FIDO2/WebAuthn keys resist AiTM attacks
- Harden Help Desk Verification — Implement callback verification to registered numbers
- Monitor IdP Admin Activity — Alert on MFA changes, role assignments, and SSO modifications
- Block Unauthorized RMM Tools — Allowlist approved remote access software
- Implement Number Porting Protections — Work with carriers to prevent SIM swaps
- Train Staff on Vishing — Social engineering awareness for IT support
- Monitor Collaboration Platforms — Watch for attacker reconnaissance in Slack/Teams
- Segment Cloud Access — Limit blast radius from compromised credentials
Track Scattered Spider with BRACE
BRACE delivers monthly sector-specific threat intelligence covering Scattered Spider activity, including:
- Scattered Spider campaign analysis and victim tracking
- Detection rules for social engineering and MFA bypass
- MITRE ATT&CK mappings for identity-based attacks
- Sector-specific threat hunting playbooks
- IOCs and behavioral indicators
Get the Complete Intelligence Report
Download the full Scattered Spider profile including detailed IOCs, MITRE ATT&CK mapping, detection queries, and comprehensive defensive playbooks.
Download Full Report (PDF)Stay Ahead of Scattered Spider
BRACE delivers monthly threat intelligence on Scattered Spider and 175+ other threat groups with detection rules and hunting playbooks for your sector.