SCATTERED SPIDER

Scattered Spider is a loosely organised, financially motivated cybercriminal collective comprising primarily young, English-speaking threat actors based in the United States and United Kingdom. Unlike the stereotype of state-sponsored hackers, Scattered Spider members are largely teenagers and young adults who communicate through online gaming communities, Discord, and Telegram channels collectively known as "The Com."

Despite their age and apparent informality, Scattered Spider has demonstrated sophisticated social engineering capabilities that have outmanoeuvred the security controls of major corporations. Their hallmark attack methodology involves telephonic impersonation of IT helpdesk staff, where they convince corporate employees or IT administrators to reset credentials or bypass multi-factor authentication (MFA), granting the group initial access to enterprise networks.

The group achieved international infamy through their 2023 attacks on MGM Resorts International and Caesars Entertainment, two of the largest casino operators in the United States. The MGM breach caused an estimated $100 million USD in losses and disrupted casino and hotel operations across Las Vegas for over a week. Caesars quietly paid a reported $15 million ransom to suppress public disclosure.

Scattered Spider subsequently partnered with the ALPHV/BlackCat ransomware operation to deploy ransomware within compromised networks, demonstrating their evolution from pure social engineering specialists into full-spectrum cybercriminals. Multiple members have been arrested by the FBI and UK law enforcement, though the collective continues to operate under new aliases.