SCATTERED SPIDER

Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. Initially targeting CRM providers, BPO firms, and telecom companies, the group expanded in 2023 to include gaming, hospitality, retail, MSPs, manufacturing, and financial sectors. Scattered Spider uses social engineering to impersonate IT and help-desk staff, bypass MFA, and compromise enterprise networks. The group employs ransomware for financial gain and has adapted its tooling to evade EDR defenses, targeting hybrid cloud and identity environments like Okta, AWS, and Office 365.