Loading story…
The U.S. Department of Health and Human Services' Health Sector Cybersecurity Coordination Center (HC3) warned that Scattered Spider is actively targeting healthcare and other industries with sophisticated social engineering, including help-desk impersonation, phishing, MFA fatigue, SIM swapping, and AI-assisted lures. The financially motivated group—also tracked as Octo Tempest, UNC3944, 0ktapus, and Muddled Libra—has built a reputation for using native English-speaking operators to trick employees and IT staff into resetting passwords, enrolling attacker-controlled MFA devices, and granting remote access. Federal guidance says the actors often abuse trusted tools and cloud services after initial access, making intrusions harder to distinguish from legitimate activity.
U.S. agencies and private-sector researchers have linked Scattered Spider to data theft, extortion, and collaboration with ALPHV/BlackCat ransomware operations, with victims spanning hospitality, gaming, retail, technology, and now heightened concern for healthcare organizations. Microsoft and the FBI/CISA have described the group as unusually dangerous because it combines persuasive phone-based deception with credential theft, reconnaissance, privilege escalation, mailbox manipulation, and deployment of ransomware on Windows, Linux, and VMware ESXi environments. Authorities have also tied the group to major incidents including attacks on MGM Resorts and Caesars, while UK investigators later examined whether Scattered Spider was connected to disruptive cyberattacks against retailers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
By May 2025, Scattered Spider had become the focus of a UK National Crime Agency inquiry into cyber-attacks affecting British retailers, marking a law-enforcement response tied to the group's activity.
The HHS Health Sector Cybersecurity Coordination Center (HC3) issued a warning to healthcare organizations that Scattered Spider was using social engineering and AI-assisted techniques to infiltrate targets and evade defenses.
Microsoft said the financially motivated group, also tracked as Octo Tempest and UNC3944, evolved from SIM swapping and cryptocurrency theft into broader enterprise compromises beginning in 2022.
Microsoft reported that by June 2023 the group had become affiliated with the ALPHV/BlackCat ransomware operation and was deploying ransomware against victim environments, including Windows and Linux systems.
The FBI and CISA published a joint advisory detailing Scattered Spider's tactics, techniques, and procedures, including help-desk impersonation, phishing, MFA fatigue, SIM swapping, data theft, and collaboration with ALPHV/BlackCat.
Microsoft released a public threat profile describing Octo Tempest/Scattered Spider as a highly dangerous English-speaking financial hacking group using advanced social engineering, credential theft, and ransomware tactics across multiple sectors.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
theguardian.com
Open sourcehipaajournal.com
Open sourceindustrialcyber.co
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Group-IB reported that **Scattered Spider** is better understood as a decentralized cybercrime collective rather than a single, tightly organized threat group. The company said multiple small, independent subclusters share tactics, tools, and social-engineering tradecraft, including phishing pages impersonating **Okta** and other identity providers, along with **vishing**, **smishing**, **SIM swapping**, and remote-access tooling to gain access to enterprise environments. The report linked these subclusters to intrusions affecting telecoms, marketing and communications providers, enterprises, cryptocurrency users and firms, BPOs, and support organizations, and associated the broader ecosystem with incidents involving **Twilio** customers, **Riot Games**, **MGM**, **Caesars**, **Co-op**, and **Marks & Spencer**. Group-IB also highlighted overlap with aliases including **0ktapus**, **UNC3944**, **Muddled Libra**, and **Octo Tempest**, warning that arrests of individual actors are unlikely to dismantle the threat because separate operators can continue working independently.
Jul 8, 2026
MGM Resorts and Caesars Entertainment were hit in closely timed cyberattacks that investigators and security firms tied to the **Scattered Spider** criminal community, a loose English-speaking group known for social engineering, SIM swapping, phishing, and MFA fatigue. Caesars disclosed that attackers stole customer data and reportedly paid a ransom demand, while MGM suffered a far more disruptive intrusion that knocked hotel and casino operations offline for days and was later estimated to have cost about **$100 million**. Multiple reports said the intrusions involved help-desk impersonation and other employee-targeting tactics, with Scattered Spider affiliates also linked to ransomware operators including **BlackCat/ALPHV**. The fallout expanded beyond the initial breaches as Caesars sent breach notifications to thousands of affected people and both casino companies faced lawsuits and class actions alleging failures to protect personal information. Law enforcement pressure then intensified: investigators in the US, UK, and Spain pursued suspected Scattered Spider members, including a 22-year-old British man arrested in Spain as an alleged leader and a 17-year-old arrested in the UK over the MGM attack, with additional US arrests and prosecutors reportedly moving closer to charges. Security researchers said the Las Vegas casino intrusions put a bullseye on the group, which had evolved from SIM-swapping into ransomware, extortion, and cloud-focused intrusions against major enterprises.
Jun 29, 2026
CrowdStrike reported that two financially motivated threat groups tied to **The Com** — **Cordial Spider** and **Snarky Spider** — are carrying out rapid data-theft and extortion campaigns against U.S.-based organizations across critical infrastructure and enterprise sectors, including aviation, retail, hospitality, financial services, legal, technology, automotive, and academia. The actors are closely aligned with the **Scattered Spider** playbook and have used voice phishing, text messages, email, and other social-engineering tactics since at least October 2025 to compromise identity platforms, steal credentials, session keys, and tokens, and pivot through victims’ SaaS environments. Ransom demands have reportedly reached seven figures, and some victims have also faced **DDoS** attacks or swatting. The intrusions rely on adversary-in-the-middle phishing pages that mimic legitimate single sign-on and identity-provider portals, enabling access to services such as **SharePoint**, **HubSpot**, and **Google Workspace** while largely bypassing traditional endpoint defenses. After gaining access, the attackers register their own MFA devices or emulators, disable or suppress alerts through inbox rules and email deletion, and move quickly to search for sensitive data and exfiltrate it, in some cases within an hour of initial access. Researchers said the groups differ in tradecraft — including operating hours, phishing infrastructure, leak sites, and MFA-registration methods — while both use commercial VPNs and residential proxy networks such as **Mullvad**, **Oxylabs**, **NetNut**, **9Proxy**, **Infatica**, and **NSOCKS** to blend into normal traffic and evade detection.
Jun 29, 2026