Overview
Scattered Spider emerged in early 2022 as a financially motivated cybercriminal cluster composed primarily of native English-speaking actors based in the United States and United Kingdom. Early activity focused on telecommunications providers and third-party service organizations, using SIM swapping and account takeovers before expanding into enterprise environments.
The group is distinguished by its reliance on social engineering and process abuse rather than malware development or vulnerability exploitation. Scattered Spider operators demonstrate a high degree of fluency in Western corporate environments, particularly IT help desks, identity verification procedures, and employee support workflows. This familiarity enables them to bypass technical controls through impersonation and identity compromise instead of exploit-based intrusion.
Scattered Spider operates within a broader English-speaking cybercriminal ecosystem commonly referred to as The Com, characterized by young participant demographics and decentralized collaboration. The cluster’s access-focused tradecraft has made it a frequent upstream enabler for ransomware operations, positioning it as a persistent and adaptable intrusion threat despite sustained law enforcement pressure.
| Group Alias/Names | Scattered Spider, Octo Tempest, UNC3944, Muddled Libra |
| Motivation | Financial |
| Threat Classification | CyberCrime |
| Amount of available information | High |
| Date of profile publication or date of last update | 9 Feb 2026 |
| Profile author / Analyst | Jon DiMaggio |
| Date of activity | Present |
Profile last updated: 9 February 2026
Operations & TTPs
Initial Access
Scattered Spider’s operations are built around the deliberate manipulation of enterprise identity and support processes. Initial access is typically achieved without malware exploitation, relying instead on direct interaction with people, policies, and verification workflows that were never designed to withstand adversarial pressure. The group consistently targets the human layer of enterprise security, treating help desks, identity systems, and account recovery processes as primary attack paths rather than support functions.
Voice Phishing (Vishing):
Operators conduct targeted reconnaissance using LinkedIn, social media, breach data, and open-source intelligence to build credible employee personas. Calls are placed directly to internal IT or outsourced help desks, where attackers impersonate employees and provide personal identifiers such as date of birth, manager name, and employee ID. These interactions routinely result in password resets or MFA re-enrollment, ultimately leading to control over enterprise authentication systems and access across cloud and internal services. In multiple incidents, including the MGM Resorts intrusion, full tenant compromise was achieved in a single call lasting less than ten minutes.
SMS Phishing (Smishing):
Scattered Spider has conducted large‑scale smishing campaigns that direct victims to adversary‑controlled single-sign-on portals. The August 2022 “0ktapus” campaign targeted more than 130 organizations and resulted in the compromise of thousands of credentials and MFA tokens across technology and SaaS providers.
Collectively, these operations illustrate how Scattered Spider scales the same access techniques across disparate industries, with impact driven more by organizational dependency on identity systems than sector-specific vulnerabilities.
SIM Swapping:
Early operations relied heavily on SIM‑swap attacks against telecommunications providers and third-party vendors supporting carrier operations. Control of mobile numbers enabled account recovery abuse, MFA interception, and downstream access to enterprise environments.
MFA Fatigue and Push Abuse:
In later campaigns, operators supplemented vishing with MFA push flooding, inducing victims to approve authentication requests or contact help desks where attackers could further manipulate recovery processes.
Across observed incidents, Scattered Spider’s initial access success has depended less on individual techniques than on the group’s ability to exploit help desk time pressure, incomplete verification procedures, and implicit trust embedded in enterprise identity workflows.
High-Profile Attacks
MGM Resorts – September 2023
Scattered Spider operators identified an MGM employee using publicly available professional networking information and successfully impersonated the individual during a help desk call. Administrator credentials were obtained, followed by manipulation of the identity provider to establish persistence. ALPHV BlackCat ransomware was later deployed across more than 100 ESXi hypervisors, resulting in widespread operational disruption including slot machine outages, hotel system failures, and reservation platform downtime. MGM reported approximately $100 million in losses, declined ransom payment, and later agreed to a $45 million class-action settlement in January 2025.
Caesars Entertainment – September 2023
Attackers compromised a third-party IT support vendor through social engineering, gaining access to Caesars’ loyalty database containing sensitive customer information. Caesars negotiated and paid a ransom reportedly totaling approximately $15 million. Law enforcement later confirmed partial cryptocurrency seizure prior to conversion.
0ktapus Smishing Campaign – August 2022
A coordinated credential harvesting campaign targeted major technology providers, including Twilio, Mailchimp, and Cloudflare. Compromised credentials enabled secondary intrusions affecting downstream customers, including the exposure of limited Signal user metadata. The campaign demonstrated Scattered Spider’s ability to scale access operations across multiple organizations simultaneously.
Tools & Malware
Scattered Spider primarily relies on legitimate administrative tooling and living-off-the-land techniques, allowing malicious activity to blend into normal enterprise operations and reducing detection.
Remote Monitoring and Management
Fleetdeck.io, AnyDesk, ScreenConnect (ConnectWise Control), Splashtop, and Tactical RMM have all been observed for persistent access, lateral movement, and remote control.
Custom Malware
Spectre RAT has been documented by CISA in ALPHV/BlackCat intrusions. In a limited number of cases, private-sector incident responders have reported its presence in intrusions where access was consistent with Scattered Spider tradecraft.
Phishing Infrastructure
The group maintains credential-harvesting infrastructure designed to closely mimic identity provider portals, particularly Okta and Azure-based SSO workflows.
Exploits
Scattered Spider does not rely on zero-day exploitation as a primary access mechanism. Publicly disclosed and unpatched vulnerabilities are occasionally abused, but the group’s operational advantage remains its ability to bypass technical defenses through identity compromise and human manipulation rather than exploit development.
Infrastructure
Domain Registration Patterns
Phishing domains are typically registered immediately prior to campaigns and often employ typosquatting or business-themed naming conventions that closely resemble legitimate SSO or IT support services.
Data Leak Sites
Scattered Spider does not maintain dedicated leak infrastructure and instead relies on partner ransomware data leak sites operated by ALPHV/BlackCat, RansomHub, and DragonForce.
Persona
Scattered Spider operates within The Com ecosystem, an English-speaking cybercriminal environment characterized by young participant demographics, aggressive posturing, and coercive behavior tied to social-engineering-driven intrusions. Communication and coordination primarily occur across Telegram and Discord, with frequent channel churn driven by platform enforcement actions and sustained law-enforcement pressure.
Within this ecosystem, status and visibility often matter nearly as much as financial gain, influencing both target selection and public behavior.
Scattered Spider does not exhibit a centralized leadership structure. Multiple individuals have been publicly identified through court filings and law-enforcement actions as participants in cluster-associated activity. These individuals represent documented defendants rather than a comprehensive roster of membership.
Known Actors and Personas
| Real Name | Known Alias(es) | Age / Location | Legal Status |
| Noah Michael Urban | Sosa, King Bob, Elijah | 20, Florida (US) | Sentenced to 10 years imprisonment (Aug 2025) |
| Tyler Robert Buchanan | TylerB | 23, Scotland (UK) | Arrested in Spain; extradited to the United States (Apr 2025) |
| Thalha Jubair | EarthtoStar, Brad, Austin, @autistic | 19, East London (UK) | Charged in connection with 120+ intrusions; co-founder of Star Fraud Chat |
| Ahmed Hossam Eldin Elbadawy | AD | 23, Texas (US) | Indicted (Nov 2024) |
| Evans Onyeaka Osiebo | Unknown | 20, Texas (US) | Indicted (Nov 2024) |
| Joel Martin Evans | joeleoli | 25, North Carolina (US) | Indicted (Nov 2024) |
| Owen David Flowers | Unknown | 18, Walsall, England (UK) | Charged in connection with UK transport and healthcare intrusions |
Critical Differentiation: Scattered Spider vs. ShinyHunters vs. SP1D3R HUNTERS
Scattered Spider represents a distinct social‑engineering‑centric intrusion cluster. It should not be conflated with ShinyHunters’ database‑theft operations or with SP1D3R HUNTERS, which functions solely as coordination infrastructure rather than an operational group.
Targets
Primary Industries: Telecommunications, BPO providers, gaming and hospitality, technology and SaaS platforms.
Geographic Focus: United States (primary), United Kingdom (secondary), with opportunistic global targeting.
Attribution Theory
Confidence Level: High
Attribution is supported by consistent TTPs, infrastructure overlap, behavioral indicators, and corroborating legal action. Multiple indictments explicitly name Scattered Spider members, and independent vendor analysis confirms continuity across campaigns.
Attribution Guidance for Analysts
Attribution should prioritize observed TTPs and monetization models over branding or Telegram claims. Presence within Com‑ecosystem coordination channels alone is insufficient for Scattered Spider attribution.
Notes
Scattered Spider highlights the risk posed by socially skilled, process-driven intrusion clusters. While law enforcement actions have disrupted individual operators, the core tradecraft remains effective and easy to replicate. Absent meaningful changes to enterprise identity controls and help desk security models, this intrusion methodology is likely to persist.