Scattered Spider

Scattered Spider, also known as Octo Tempest, 0ktapus, and UNC3944, is a notorious threat actor group involved in major data extortion campaigns. This cybercriminal group has been associated with high-profile attacks on organizations like Caesars Entertainment and MGM, often in collaboration with the Black Cat/ALPHV ransomware group. The group's modus operandi involves searching SharePoint repositories for information, maintaining persistence on targeted networks, and exfiltrating data for extortion purposes. They also exploit infrastructure, such as remote systems, and use phishing techniques to obtain login credentials, thereby gaining access to victim's networks. Throughout 2024, authorities globally have made significant strides in apprehending members of Scattered Spider. In January, U.S. authorities arrested Noah Michael Urban, a 19-year-old from Florida, suspected of being part of this group. Later in July, law enforcement in the U.K. arrested a 17-year-old teenager from Walsall, also believed to be a member of Scattered Spider. These arrests highlight the global nature of this cybercrime group, with its members spread across different regions. The U.S. Justice Department has charged five alleged members of Scattered Spider with conspiracy to commit wire fraud, marking a significant move in the fight against cybercrime. Despite these developments, the threat posed by Scattered Spider remains substantial. They are part of a broader cybercriminal community called "The Com," where hackers brag about high-profile cyber thefts. Over the past two years, Scattered Spider is suspected of hacking into hundreds of organizations, including Twilio, LastPass, DoorDash, and Mailchimp. The persistent threat underscores the need for continued vigilance and proactive cybersecurity measures.