Scattered Spider: What You Need to Know

Scattered Spider is not your average cybercrime group. With tactics that blur the line between traditional cybercrime and nation-state-level sophistication, this group has quickly become one of the most dangerous threat actors in the wild today.

Their recent campaigns—targeting UK retailers like Marks & Spencer and Co-op, and previously launching high-impact attacks on casinos—demonstrate a clear pattern: they strike hard, fast, and with precision, often focusing on one industry at a time. Now, with credible intelligence suggesting they’re pivoting toward the insurance sector, organizations across all verticals must prepare for what’s coming.

What Sets Scattered Spider Apart

Unlike typical cybercriminals who rely on automated tools and spray-and-pray tactics, Scattered Spider engages in real-time, human-driven attacks. Their operational security is tight, their infrastructure rotates frequently, and their impersonation skills are alarmingly convincing.

The group’s tactics, techniques, and procedures (TTPs) are rooted in deception and technical prowess. Here’s how they typically infiltrate and exploit organizations:

Here’s how they’re redefining the threat landscape:

Initial Access

Smishing & Vishing: Social engineering via SMS and voice calls.
Help Desk Impersonation: Convincing support staff to reset credentials.
SIM Swapping: Hijacking phone numbers to bypass authentication.

Post-Access Activities

Credential Phishing: Using fake domains with terms like “okta,” “sso,” or “corp.”
Active Directory Compromise: Extracting NTDS.dit files from domain controllers.
Lateral Movement: Leveraging RDP, SSH, PsExec, and scheduled tasks.
Persistence: Installing remote monitoring tools like AnyDesk.
Credential Dumping: Using tools like Mimikatz and secretsdump.py.
Ransomware Deployment: Employing DragonForce RaaS for double extortion.

Defensive Measures: What You Can Do

To protect your organization from threats like Scattered Spider, Varonis Threat Labs recommends the following:

Strengthen Help Desk Protocols: Enforce strict identity verification.
Use Phishing-Resistant MFA: Prefer hardware tokens or number-matching.
Ensure Endpoint Coverage: Deploy and monitor EDR tools across all devices.
Filter Web Traffic: Block suspicious domains via web proxies.
Monitor Critical Data Stores: Detect anomalies with tools like Varonis.
Conduct Red-Team Exercises: Simulate attacks to test defenses.
Restrict Server Internet Access: Apply default-deny firewall rules.
Keep Systems Updated: Patch OS and applications regularly.
Maintain Secure Backups: Store offline and test for reliability.

Given the sophistication of these attacks, traditional defenses are no longer enough. Organizations need a layered, proactive approach that addresses both technical and human vulnerabilities:

1. Strengthen Identity Verification

Use multi-layered identity checks for all sensitive requests.
Implement out-of-band verification for help desk interactions.
Train staff to verify identities independently before taking action.

2. Enforce Zero Trust Principles

Apply least privilege access across all systems.
Use role-based access controls with regular audits.
Assume no user or device is trustworthy by default.

3. Secure Connected Applications

Restrict who can authorize or install third-party apps.
Monitor tools like Salesforce Data Loader and permissions like “API Enabled.”
Use IP allowlisting and activity monitoring for all integrations.

4. Invest in Real-Time Monitoring

Deploy EDR solutions to detect credential theft and lateral movement.
Set up automated alerts for unusual access patterns or data downloads.
Monitor cloud and SaaS environments continuously.

5. Upgrade MFA Implementation

Use phishing-resistant MFA (e.g., FIDO2-compliant security keys).
Require MFA for all access points, including APIs and third-party apps.
Train users to recognize and report MFA fatigue attacks.

6. Prioritize Human-Centered Security

Provide targeted training for help desk and privileged users.
Foster a culture where employees feel empowered to question suspicious requests.
Keep teams updated on emerging social engineering tactics.

7. Manage Third-Party Risk