Scattered Spider | Who They Are, How They Attack, and How to Stop Them
Brief
Scattered Spider is a loosely organized cybercrime collective known for breaking into major companies through social engineering rather than malware, tricking help desks and employees into handing over access instead of hacking their way in.
Active since at least 2022, the group has been linked to attacks on MGM Resorts, Caesars Entertainment, Marks & Spencer, and a growing list of airlines, insurers, and retailers, often deploying DragonForce or ALPHV ransomware once inside a victim’s network.
Despite a string of arrests across the US, the UK, and Spain since 2024, the group’s activity hasn’t stopped; it’s shifted, moving sector by sector as new members adopt the same playbook.