Understanding Scattered Spider and the rise of identity-based cyberattacks

It might sound like the basis for a cinematic thriller: a cybercriminal group known for moving quickly, dodging investigations by decentralizing their operations and pivoting across not only industries but also targeted regions. However, this organization, known as Scattered Spider, is a very real threat faced by businesses.

Scattered Spider remains one of the most active and effective cybercriminal groups targeting large organizations. While many groups rely primarily on software vulnerabilities, Scattered Spider is known for exploiting people, business processes and identity systems to gain access to corporate networks. Recent warnings from government agencies and industry partners indicate the group continues to refine its tactics, making it a significant threat across multiple industries.

To help organizations stay informed about Scattered Spider and the cybercrime groups that it’s aligned with under Scattered LAPSUS$ Hunters (SLH), Mike McCauley, director of cyber threat management and response at BOK Financial®, provided the following information:

Who is Scattered Spider?

Scattered Spider is a financially motivated cybercrime group known for conducting sophisticated social engineering attacks against corporate employees, contractors and IT support organizations. The cybercrime group has been linked to data theft, extortion and ransomware incidents targeting large enterprises worldwide. Rather than simply exploiting a single technology weakness, Scattered Spider focuses on stealing identities and abusing trusted business processes.

Who are the Scattered LAPSUS$ Hunters (SLH)?

In 2025, elements associated with Scattered Spider, LAPSUS$ and ShinyHunters began presenting themselves under a shared banner, Scattered LAPSUS$ Hunters (SLH). Researchers characterize SLH as a federated alliance rather than a conventional merger, in that a small core appears to coordinate multiple personas and affiliates while combining Scattered Spider’s social-engineering and identity-access methods, LAPSUS$’s disruptive extortion style and ShinyHunters’ data-theft and leak operations. The collective has used Telegram as a public communications, recruitment and extortion hub and has promoted an affiliate-oriented “extortion-as-a-service” model.

What does Scattered Spider do?

Recent cyber threat intelligence reporting shows Scattered Spider continuing to target identity systems such as Microsoft Entra ID, single sign-on platforms, virtual desktop infrastructure and cloud services. The group frequently impersonates employees during calls to service desks, requesting password resets or changes to MFA settings.

Once access is obtained, attackers search cloud platforms, collaboration tools and file repositories to identify sensitive information, such as privileged accounts, network documentation and valuable proprietary business data. They have also been observed monitoring platforms such as Microsoft Teams and Slack to better understand internal operations and identify additional opportunities for compromise.

Many modern attacks no longer focus solely on encrypting systems. These threat actor groups prioritize stealing data and threatening public disclosure unless a ransom is paid. Government and industry reporting indicates Scattered Spider has demonstrated a strong focus on data theft and extortion, making the protection of sensitive information and rapid detection capabilities increasingly important.

Researchers have observed Scattered Spider concentrating on specific industries for periods of time before shifting focus. Recent activity has affected multiple industries, including retail, insurance, aviation, telecommunications, hospitality, technology companies and financial services organizations. Organizations should recognize that being outside a currently targeted industry does not eliminate risk, as the group has repeatedly shifted its focus between sectors.

What are Scattered Spider’s tactics?

Scattered Spider uses sophisticated social engineering techniques, manipulating people into giving away secrets through various methods:

• IT help desk vishing: Impersonating employees or executives over the phone (voice phishing) to manipulate IT help desks into bypassing controls and resetting credentials.
• MFA fatigue and push bombing: Overwhelming targets with multi-factor authentication (MFA) push notifications or using SIM-swapping to hijack mobile numbers and intercept second-factor codes.
• Living off the land (LOTL): Leveraging legitimate, pre-installed administrative tools, cloud management consoles and remote monitoring software (RMM) to avoid detection by endpoint security tools.
• Cloud and SaaS targeting: Pivoting aggressively into cloud environments, SaaS applications (such as identity providers and customer support platforms) and identity databases, rather than just traditional local endpoints.
• Extortion and ransomware partnerships: Exfiltrating sensitive corporate data for monetary extortion and deploying ransomware variants (such as DragonForce or earlier ALPHV/BlackCat operations) via VMware ESXi and enterprise hypervisors.
• Ecosystem resilience: Operating via loose networks of young, globally distributed operators who rapidly backfill roles following international arrests and extraditions across North America and Europe. Much of this talent is drawn from “The Com,” an informal, primarily English-speaking online milieu rather than a single organization. Its fluid communities overlap across cybercrime, SIM swapping, credential theft, social engineering, data brokering, extortion and related fraud. Participants may share access, tools, infrastructure, techniques and criminal branding or move between crews as opportunities arise. This loose structure gives groups such as Scattered Spider access to a broad pool of specialists and affiliates while making membership and attribution difficult to define.

What are some steps to defend your organization and yourself?

Organizations and individuals can take several steps to help protect themselves against Scattered Spider and similar threats, according to McCauley. Businesses should consult with cyber security experts and evaluate whether their organization should strengthen identity verification or use stronger multifactor authentication.  Additionally, organizations should:

• Train employees to recognize social engineering.
• Monitor for unusual activity.
• Prepare for data extortion scenarios.

Meanwhile, individuals can:

• Be cautious of unexpected phone calls, emails or text messages requesting passwords, security codes or account information.
• Never approve an MFA request you did not initiate.
• Use strong, unique passwords for important accounts and consider using a password manager.
• Enable MFA wherever it is available.
• Verify requests through a trusted contact method, especially when someone claims to be from your bank, employer or technology provider.
• Keep devices, operating systems and applications updated with the latest security patches.
• Monitor financial and online accounts regularly for unusual activity.
• Be wary of urgent requests that create pressure to act quickly or bypass normal procedures.

The bottom line

While their tactics may change, Scattered Spider’s underlying goal remains the same: gaining access to sensitive information and systems. Taking a proactive approach to identity security, employee education and incident preparedness can help organizations reduce their exposure and respond more effectively when threats emerge. Vigilance remains one of the most important cybersecurity tools.