Deconstructing Scattered Spider
Anders Meyer | CEO, FastPasscorp
Scattered Spider (also known as UNC3944, Octo Tempest, and Muddled Libra) has emerged as one of the most aggressive and effective financially motivated cybercriminal groups active today.1 Comprised of young, native English-speaking individuals, this decentralized collective has distinguished itself through an expert-level mastery of social engineering, which it uses to bypass even sophisticated security controls at major enterprises.2 The group has been linked to a series of high-profile, disruptive attacks against companies like MGM Resorts, Caesars Entertainment, Marks & Spencer Coop, Harrods and Quantas, resulting in financial losses estimated in the hundreds of millions of dollars.1
The linchpin of Scattered Spider's attack methodology is not a technical exploit, but a procedural one: manipulating IT help desk personnel via phone calls (a technique known as "vishing") to reset passwords and, critically, re-enroll Multi-Factor Authentication (MFA) devices.2 This tactic effectively turns an organization's own identity recovery process into the primary attack vector. Once inside a network, the group demonstrates a high operational tempo and deep knowledge of enterprise IT and cloud environments, using legitimate tools to remain undetected while escalating privileges and exfiltrating massive amounts of data for a dual-threat extortion scheme involving ransomware.1
Defending against this threat requires a strategic shift away from relying solely on technology and user training. This report details the group's methodology and outlines the two most critical pillars of defense:
- Hardening the Human Firewall at the Service Desk: This is the single most important defense. By removing human discretion from the identity verification process and implementing an automated, policy-driven system, organizations can neutralize Scattered Spider's primary initial access vector.
- Enforcing Strict Identity and Access Management (IAM) Hygiene: Implementing the principle of least privilege and controlling the use of remote access tools are crucial secondary defenses that limit an attacker's ability to move laterally and cause damage if they do manage to breach the perimeter.
Threat Actor Profile: The Architects of Deception
- Identity and Demographics: Scattered Spider is a decentralized collective of cybercriminals, many of whom are believed to be young adults between 19 and 22 years old, located primarily in the United States and the United Kingdom.9 Their native English fluency and cultural familiarity with Western business practices give them a significant advantage in social engineering campaigns.4
- Motivation and Evolution: The group is financially motivated and has rapidly evolved since emerging in May 2022.9 Initially focused on SIM swapping and credential theft, they have become a highly sought-after initial access broker and affiliate for top-tier Ransomware-as-a-Service (RaaS) operations, including BlackCat/ALPHV, Qilin, and DragonForce.1 Their operations have escalated from simple fraud to orchestrating multi-million-dollar extortion campaigns.1
- Targets: Scattered Spider targets large enterprises across a wide range of sectors, including hospitality, retail, finance, telecommunications, healthcare, and critical infrastructure.2
The Attack Playbook: A Step-by-Step Analysis
Scattered Spider’s attack chain is a calculated, multi-stage process that systematically dismantles security controls by exploiting trust at the human, procedural, and technical levels.
Phase 1: Initial Access through Social Engineering
The entire operation hinges on the group's mastery of social engineering. They do not brute-force their way in; they talk their way in.
- Reconnaissance and Phishing: The attack begins with broad-based phishing and "smishing" (SMS phishing) campaigns to harvest employee credentials and personally identifiable information (PII).1 They register deceptive domains that mimic corporate services (e.g., using keywords like “okta,” “sso,” or “vpn”) to create convincing fake login portals.5
- The Vishing Pivot: This is Scattered Spider's signature tactic. Armed with a legitimate employee's credentials and PII, an attacker calls the organization's IT help desk.6 They impersonate the employee—often a high-value target—claiming to be locked out of their account.12 With a convincing story and a sense of urgency, they persuade the help desk agent to reset the account's password or, more critically, to enroll a new, attacker-controlled device for MFA.3 This act of manipulation bypasses MFA entirely by co-opting the legitimate recovery process.1
Phase 2: Persistence, Escalation, and Lateral Movement
Once inside, the group uses a "Living off the Land" (LOTL) strategy to blend in with normal administrative activity and avoid detection.4
- Establishing Persistence: Instead of deploying obvious malware, they use legitimate Remote Monitoring and Management (RMM) tools like AnyDesk, ScreenConnect, and TeamViewer.2 They often install multiple RMM tools to create redundant backdoors, ensuring their access persists even if one is discovered.7
- Internal Reconnaissance: The attackers meticulously search internal resources like SharePoint, Microsoft Teams, and Slack for IT documentation, network diagrams, and even conversations among security personnel about the ongoing incident, allowing them to adapt their tactics in real-time.6
- Privilege Escalation: They are adept at escalating privileges within enterprise environments. They use tools like Mimikatz to dump credentials from memory, extract the NTDS.dit file from domain controllers for offline password cracking, and abuse misconfigurations in Active Directory Certificate Services (ADCS).14
- Cloud Environment Exploitation: Their expertise extends to hybrid cloud environments. They show proficiency in both AWS and Azure, often creating their own unmanaged virtual machines inside the victim's cloud subscription.6 They abuse compromised Identity and Access Management (IAM) roles and have used cloud-native tools like Azure Data Factory to exfiltrate stolen data.1
Phase 3: Impact and Extortion
The final stage is focused on monetization through a dual-threat extortion strategy.
- Data Exfiltration: The attackers exfiltrate massive volumes of sensitive data to third-party cloud storage services like MEGA.nz.6 This data theft serves as leverage for extortion.
- Ransomware Deployment: As the final act, Scattered Spider deploys potent ransomware from its RaaS partners. They strategically target business-critical infrastructure, particularly VMware ESXi servers, to encrypt hundreds of virtual machines simultaneously, maximizing operational disruption and pressuring the victim to pay.2
The Two Pillars of Defense Against Scattered Spider
Conventional defenses like user training and standard MFA are not enough to stop a determined adversary who targets processes rather than just technology. An effective defense must be built on two core pillars that directly counter the group's TTPs.
Pillar 1: Hardening the Human Firewall at the Service Desk (Most Important)
The single most critical defense against Scattered Spider is to secure the IT help desk, their primary point of entry. The goal is to make it impossible for an agent to be manipulated into bypassing security policy. This cannot be achieved with training alone; it requires a technical control that enforces a secure, repeatable identity verification process.
A solution like FastPass Identity Verification Manager (IVM) is designed specifically for this purpose. It neutralizes the vishing threat by fundamentally changing how verification is handled:
- Automated, Structured Workflows: FastPass IVM takes control of the verification process out of the agent's hands. When a user calls for a reset, the agent initiates a session in IVM, which then dictates a pre-defined, management-approved workflow.16 The agent is guided through a series of required checks and cannot be persuaded to skip steps or deviate from policy, directly countering the attacker's ability to use urgency and manipulation.16
- Dynamic and Contextual Verification: Stolen static PII (like a Social Security Number or mother's maiden name) is rendered useless. IVM verifies identity using dynamic, contextual information that an attacker cannot easily possess.16 This can include verifying the user's PC identity, their current geo-location, recent login patterns, or other corporate data pulled in real-time from systems like Active Directory.16
- Point-Based Authentication: IVM uses a flexible, point-based scoring system. Each successful verification check adds points to a trust score. A password reset or MFA enrollment is only authorized once a configurable point threshold has been met.16 This ensures that a single compromised piece of information is never sufficient to compromise an account.
- Seamless Integration: IVM integrates directly into existing ITSM platforms like ServiceNow, becoming a natural part of the help desk agent's toolkit and ensuring consistent adoption.16
By implementing such a system, an organization transforms its help desk from its most vulnerable attack surface into a fortified checkpoint, neutralizing Scattered Spider's most effective tactic at its source.
Pillar 2: Enforcing Strict Identity and Access Management (IAM) Hygiene
The second pillar of defense focuses on minimizing the potential damage if an attacker does manage to gain a foothold. This involves rigorous internal controls that limit an attacker's ability to escalate privileges and move laterally.
- Implement the Principle of Least Privilege (PoLP): All users, service accounts, and administrators should have only the minimum permissions necessary to perform their roles.2 This is critical for both on-premises (Active Directory) and cloud (IAM) environments. Regularly audit accounts and access levels, and remove unnecessary administrative rights.18 This practice severely curtails an attacker's ability to move from a compromised user account to a domain administrator.
- Control and Monitor Remote Access Tools: Scattered Spider relies on legitimate RMM tools to maintain persistence.2 Organizations must establish firm control over these tools.
- Audit and Allowlist: Conduct a thorough audit to identify all RMM software in the environment. Create a policy that explicitly defines which tools are authorized.20
- Block Unauthorized Tools: Use application control policies (like GPO-based Software Restriction Policies) and network firewalls to block the execution of and traffic to any unauthorized RMM software.20 This prevents attackers from easily installing their preferred backdoors.
- Strengthen Authentication Everywhere: While Scattered Spider bypasses MFA at the help desk, strong authentication remains a critical layer of defense.
Mandate phishing-resistant MFA (such as FIDO2 keys) for all users, especially for privileged accounts and access to critical systems.18 This reduces the risk from the initial credential harvesting phase of their attacks.
Conclusion
Scattered Spider represents the evolution of cybercrime, where human deception is as powerful a weapon as any piece of malware. Their success is a clear signal that attacking business processes, particularly the trust-based interactions at the IT service desk, yields a high return on investment.
Defending against this modern threat requires a modern, layered strategy. While security awareness training and IAM hygiene are essential, they are not sufficient on their own. The most critical and impactful defense is to harden the exact process that these attackers exploit. By deploying an automated identity verification solution like FastPass IVM at the service desk, organizations can build a resilient "human firewall" that is immune to social engineering. This, combined with a rigorous commitment to the principle of least privilege and control over remote access software, provides the robust defense-in-depth posture needed to de-fang the Scattered Spider threat.
Works cited
- Scattered Spider Ransomware Group: Activity, TTPs, & More - BitSight Technologies, accessed on July 3, 2025, https://www.bitsight.com/blog/who-is-scattered-spider-ransomware-group
- Threat Profile: Scattered Spider - Adarma, accessed on July 3, 2025, https://adarma.com/blog/scatterd-spider/
- Netskope Threat Coverage: Scattered Spider, accessed on July 3, 2025, https://www.netskope.com/blog/netskope-threat-coverage-scattered-spider
- hc3 tlp clear threat actor profile scattered spider-10-24-2024.pdf - American Hospital Association, accessed on July 3, 2025, https://www.aha.org/system/files/media/file/2024/10/hc3%20tlp%20clear%20threat%20actor%20profile%20scattered%20spider-10-24-2024.pdf
- How Scattered Spider TTPs are evolving in 2025 - Push Security, accessed on July 3, 2025, https://pushsecurity.com/blog/scattered-spider-ttp-evolution-in-2025/
- Scattered Spider | CISA, accessed on July 3, 2025, https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
- Scattered Spider: Threat Actor Profile - Cyble, accessed on July 3, 2025, https://cyble.com/threat-actor-profiles/scattered-spider/
- Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and Notoriety | Google Cloud Blog, accessed on July 3, 2025, https://cloud.google.com/blog/topics/threat-intelligence/unc3944-sms-phishing-sim-swapping-ransomware/
- Scattered Spider - Wikipedia, accessed on July 3, 2025, https://en.wikipedia.org/wiki/Scattered_Spider
- Scattered Spider Tactics Observed Amid Shift to US Targets - Halcyon, accessed on July 3, 2025, https://www.halcyon.ai/blog/scattered-spider-tactics-observed-amid-shift-to-us-targets
- Scattered Spider & BlackCat Ransomware: Mitigation Guidance - FS-ISAC, accessed on July 3, 2025, https://www.fsisac.com/hubfs/Knowledge/ScatteredSpider&BlackCatRansomware-MitigationGuidance.pdf
- FBI Warns of Scattered Spider's Expanding Attacks on Airlines Using Social Engineering, accessed on July 3, 2025, https://thehackernews.com/2025/06/fbi-warns-of-scattered-spiders.html
- Scattered Spider Attack Analysis - ReliaQuest, accessed on July 3, 2025, https://reliaquest.com/blog/scattered-spider-attack-analysis-account-compromise/
- What We Know About Ransomware Group Scattered Spider - Quorum Cyber, accessed on July 3, 2025, https://www.quorumcyber.com/insights/scattered-spider/
- Scattered Spider Report - Canopius, accessed on July 3, 2025, https://www.canopius.com/insurance/cyber-insurance/scattered-spider-report/
- Identity Verification Solutions for the Help Desk | FastPass, accessed on July 3, 2025, https://www.fastpasscorp.com/products/identity-verification-manager/
- What Is an Identity-Based Attack? Different Types and Prevention - Legit Security, accessed on July 3, 2025, https://www.legitsecurity.com/aspm-knowledge-base/identity-based-attacks
- The State of Identity Security for 2024: Identity-Based Threats, Breaches, & Security Best Practices - BeyondTrust, accessed on July 3, 2025, https://www.beyondtrust.com/blog/entry/the-state-of-identity-security-identity-based-threats-breaches-security-best-practices
- Securing Identities: 10 recommendations for building a stronger identity security posture, accessed on July 3, 2025, https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/securing-identities-10-recommendations-for-building-a-stronger-identity-security/4371879
- Your Screen Is Being Monitored: Initial Access via RMM Tools - ReliaQuest, accessed on July 3, 2025, https://reliaquest.com/blog/rmm-tool-abuse/
- Protecting Against Malicious Use of Remote Monitoring and Management Software | CISA, accessed on July 3, 2025, https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a
- Remote Access Tools: Friend or Foe - DefenseStorm, accessed on July 3, 2025, https://defensestorm.com/insights/remote-access-tools-friend-or-foe/
- Identity-Based Attacks To Know - Examples & Prevention | Proofpoint US, accessed on July 3, 2025, https://www.proofpoint.com/us/blog/identity-threat-defense/types-identity-threats-attacks
- 8 Types of Identity-Based Attacks | CrowdStrike, accessed on July 3, 2025, https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/identity-attack/
