Scattered SpiderThreat actor

“Cybercriminal actors such as the Scattered Spider hacking collective are known to target IT service providers to gain access to their customers’ systems.”

““I've seen Scattered Spider, I've seen ShinyHunters, I've seen Lapsus$.” For what it's worth, ShinyHunters claimed in an exclusive interview with The Register that they “don't attack human beings.” They did, however, admit that “there are times in the work we do sometimes we have…”

“The group most associated with attacks on Okta tenants that year, Scattered Spider, is one our team has tracked closely, and its whole playbook rests on identity rather than exploits.”

“This is the Intel Ethernet diagnostics driver and the Bring-Your-Own-Vulnerable-Driver (BYOVD) target (CVE-2015-2291), abused by Scattered Spider, BlackByte, and Lazarus Group to disable EDR from kernel space.”

“…hat all of these techniques have been repeatedly leveraged by other data extortion cybercriminals, such as FulcrumeSec, ExfilSquad, Scattered Spider, and Lapsus$, to target UK organizations over the last couple years.”

“…‘Rey’), was the technical operator and public face of Scattered LAPSUS$ Hunters, which he said was an amalgamation of three groups: Scattered Spider, LAPSUS$ and ShinyHunters.”

“Scattered Spider attackers, posing as employees, tricked the casino’s help desk staff to reset passwords and bypass MFA.”

“…him as one of the three administrators of Scattered LAPSUS$ Hunters (SLH or SLSH), a group that's assessed to be an amalgamation of Scattered Spider, LAPSUS$, and ShinyHunters.”

“Recently, instances of FleetDeck distribution have also been identified; FleetDeck was previously used by the “Scattered Spider” threat actors who distributed the DragonForce ransomware.”

“…as part of a cybercrime group called ScatteredLapsussHunters (SLSH), which experts say is an amalgamation of three hacking groups — Scattered Spider, LAPSUS$ and ShinyHunters.””

“…as part of a cybercrime group called ScatteredLapsussHunters (SLSH), which experts say is an amalgamation of three hacking groups — Scattered Spider, LAPSUS$ and ShinyHunters.”

“Scattered Spider Member Gets 45-Month Prison Sentence for Cybercrime Spree — Ahmed Hossam Eldin Elbadawy, of Texas, who admitted to being a member of the notorious cybercrime group Scattered Spider, has been sentenced to 45 months in prison.”

“Figure 3: Example query using Recorded MCP to create an executive report of IOCs associated with the threat group Scattered Spider.”

“We assess with high-confidence their link with "The Com", the broader cybercrime community that also includes Scattered Spider and Lapsus$, an association that became explicit in 2025 with the formation of Scattered Lapsus$ Hunters.”

“After a protracted break, the LAPSUS$ name returned in 2025, partnering with Scattered Spider and ShinyHunters in another string of cyberattacks affecting household names, before splitting up and activity dropping to a modest six attacks per month, according to SOCRadar.”

“Scattered Spider member pleads guilty: Ahmed Hossam Eldin Elbadawy, a member of the Scattered Spider hacking group, where he went as "AD," has pleaded guilty.”

“Both men are believed to be part of Scattered Spider, a cybercriminal group that has been linked to major cyber-attacks over the past few years, including the Marks & Spencer and Co-op incidents in 2025.”

“A great case study is the 0ktapus phishing campaign that led to the theft of employee identification data and 2FA codes for the purpose of carrying out supply chain attacks.”

“Roasting 0ktapus: The phishing campaign going after Okta identity credentials”

“In another significant case, Caesars Entertainment was targeted by Scattered Spider, a group closely associated with ALPHV.”