HC3 Warns Healthcare Sector on Scattered Spider Social Engineering Threat

The U.S. Department of Health and Human Services' Health Sector Cybersecurity Coordination Center (HC3) warned that Scattered Spider is actively targeting healthcare and other industries with sophisticated social engineering, including help-desk impersonation, phishing, MFA fatigue, SIM swapping, and AI-assisted lures. The financially motivated group—also tracked as Octo Tempest, UNC3944, 0ktapus, and Muddled Libra—has built a reputation for using native English-speaking operators to trick employees and IT staff into resetting passwords, enrolling attacker-controlled MFA devices, and granting remote access. Federal guidance says the actors often abuse trusted tools and cloud services after initial access, making intrusions harder to distinguish from legitimate activity.

U.S. agencies and private-sector researchers have linked Scattered Spider to data theft, extortion, and collaboration with ALPHV/BlackCat ransomware operations, with victims spanning hospitality, gaming, retail, technology, and now heightened concern for healthcare organizations. Microsoft and the FBI/CISA have described the group as unusually dangerous because it combines persuasive phone-based deception with credential theft, reconnaissance, privilege escalation, mailbox manipulation, and deployment of ransomware on Windows, Linux, and VMware ESXi environments. Authorities have also tied the group to major incidents including attacks on MGM Resorts and Caesars, while UK investigators later examined whether Scattered Spider was connected to disruptive cyberattacks against retailers.