Scattered Spider

Scattered Spider is a loosely organized, primarily English-speaking cybercriminal collective known for aggressive social engineering, credential theft, SIM swapping, help-desk impersonation, and extortion. The group is widely tracked under multiple aliases including UNC3944, Octo Tempest, 0ktapus, Muddled Libra, Storm-0875, Roasted 0ktapus, Scatter Swine, Scattered Swine, Star Fraud, DEV-0971, and LUCR-3. It has also been associated with the broader criminal ecosystem known as The Com. Members are often described as young offenders operating in a decentralized manner rather than as a rigid hierarchical organization. The group has targeted organizations in the United Kingdom, United States, and other countries across sectors including telecommunications, technology, retail, hospitality, aviation, transportation, healthcare, cloud services, and casinos. Publicly linked victim organizations and sectors indicate a preference for large enterprises with valuable identity infrastructure, customer data, and high operational dependence on IT systems, making them susceptible to disruptive extortion. Scattered Spider is especially notable for human-centric intrusion tradecraft. Common initial access methods include voice phishing, impersonation of internal IT staff or employees, manipulation of service desks to reset passwords or multi-factor authentication, use of fake single sign-on or identity-provider pages, MFA fatigue and challenge relaying, and SIM-swapping to bypass authentication controls. The group has also abused legitimate remote administration and remote monitoring tools after gaining trust or access. In more recent activity, overlapping clusters linked to the same ecosystem have used operator-driven phishing workflows to capture Microsoft 365 credentials and register attacker-controlled passkeys, enabling durable access that can survive password resets. Once inside a victim environment, Scattered Spider has demonstrated rapid privilege escalation, credential access, lateral movement, and access to identity systems and cloud-hosted collaboration platforms. The group has been associated with theft of data from enterprise file repositories and collaboration services for use in extortion, and with intrusions that caused major operational disruption even when ransomware was not the primary mechanism. Its operations frequently combine data theft, coercion, and public pressure through leak-site activity or direct extortion demands. Scattered Spider has been linked to numerous high-profile intrusions and extortion incidents, including attacks affecting major retailers, transportation providers, hospitality and casino operators, technology firms, and healthcare organizations. Authorities in the United Kingdom identified members of the group as responsible for the 2024 intrusion into Transport for London, an attack that disrupted a large number of internal systems and customer-facing services and became one of the most significant cybercrime prosecutions in UK courts. Law enforcement and industry assessments have stated that arrests of key members materially degraded the group’s operational capability, although activity under the Scattered Spider name or by overlapping actors has continued to be reported. Scattered Spider is a financially motivated threat actor rather than a nation-state operation. Its hallmark is sophisticated social engineering executed by native or fluent English speakers who convincingly interact with employees, contractors, and support personnel. The group’s success has underscored the security risk posed by identity-centric attacks that exploit human workflows, outsourced support channels, and authentication recovery processes rather than relying solely on software exploitation.