Beware: Scattered Spider cybercrime ring sparks warnings

It might sound like the basis for a cinematic thriller: a cybercriminal group known for moving quickly, dodging investigations by decentralizing their operations and pivoting across not only industries but also targeted regions. However, this organization, known as Scattered Spider, is a very real threat faced by businesses.

According to Paul Tucker, chief information security and privacy officer at BOK Financial®, the group isn’t like a typical cybercrime gang. “Scattered Spider operates more like a tech startup, recruiting young talent, partnering with other threat actors and constantly adapting their tools and strategies to be more effective,” he said.

Scattered Spider often focuses their efforts on high-value data and extortion opportunities, and their targets span 15 industries—including finance, healthcare, retail and airlines. "Some of their tactics include tricking employees, bypassing security systems and even impersonating IT staff to gain access to sensitive systems," Tucker explained.

Some of the group’s targets have included big names, like MGM Resorts & Caesars Entertainment in 2023, where criminals impersonated IT staff and tricked help desk employees into resetting log-in credentials. The group then deployed BlackCat/ALPHV ransomware, which caused widespread outages and resulted in more than $100 million in losses.

Similarly, in 2024, the group was responsible for the Snowflake Cloud Data Breach, which compromised credentials for 165 Snowflake customers, including major companies like AT&T, Ticketmaster and LendingTree. This breach resulted in massive data theft and extortion attempts targeting cloud-stored customer data across multiple industries.

A new breed of cybercriminal organization
Scattered Spider is one of the most notorious and rapidly evolving cybercriminal groups active today. Emerging in 2022, this group has gained a reputation for its bold tactics, sophisticated social engineering and corporate-style operations. As of 2025, Scattered Spider continues to evolve, absorbing other cybercriminal groups and expanding its reach, making it a top-tier threat in the global cybersecurity landscape.

“What sets Scattered Spider apart is how they behave remarkably like a rogue corporate IT department—and that's part of what makes them so dangerously effective.”

- Paul Tucker, chief information security and privacy officer at BOK Financial

The group is known to recruit or absorb other threat actors, especially those with specialized skills such as ransomware deployment, phishing infrastructure or SIM swapping. “This strategy allows them to scale operations quickly and diversify their attack methods, making them a formidable force in the cybercrime world,” Tucker explained.

Their recruitment process mirrors that of legitimate companies, complete with specific job qualifications. They seek native speakers with neutral accents for their targeted regions, typically recruiting U.S. and UK English speakers since those are their primary target areas. The group also forms strategic alliances and collaborations with other major cybercrime organizations like AlphV/BlackCat and Qilin.

“What makes them especially dangerous is that instead of operating as a single, tightly controlled group, Scattered Spider functions more like a network of affiliates—each with its own specialty but aligned under a shared brand or mission,” Tucker explained. “Think of it as a franchise model in the cybercriminal world, where the group doesn't originate from a single country but spans many nations.”

Their tactics explained
Scattered Spider uses sophisticated social engineering techniques, manipulating people into giving away secrets through various methods:

• Vishing (voice phishing). They call pretending to be from IT support, banks or other trusted entities. There's emerging evidence they're now using AI voice cloning in some instances to strengthen these tactics, according to Tucker.
• Phishing campaigns. They send fake emails asking targets to “verify” accounts or click malicious links, routinely using domains that closely resemble legitimate websites.
• SIM swapping. They trick phone companies into giving them control of victims’ phone numbers, allowing them to intercept security codes and bypass multi-factor authentication (MFA).
• IT impersonation. They convince help desk employees to reset credentials by impersonating legitimate IT staff members.

Once the bad actors gain initial access, they can steal login information, bypass security codes and access sensitive data including bank accounts and personal information.

Protection strategies: How to keep your business safe
“Cybersecurity today means protecting what we cannot see, in places we cannot reach,” Tucker said. “The best defense against attacks is preventing them.”

Organizations and individuals can take several steps to protect against Scattered Spider and similar threats.

For businesses:

• Implement non-SMS multi-factor authentication (MFA). Use app-based or hardware token multi-factor authentication when available, as SMS can be compromised through SIM swapping.
• Employee training. Regularly train employees, including help desk staff, to recognize social engineering tactics. "In today's rapidly changing landscape, businesses must ensure their employees are well trained and vigilant against cyberattacks, especially phishing attacks,” Tucker said.
• System updates. It’s critical to keep all infrastructure and computing systems up to date with security patches.
• Expanded verification methods. Always verify through separate communication channels when prompted to perform large financial transactions or sensitive operations. “It’s imperative that employees take a moment to verify emails before interacting with them and that they report suspicious activity. A single click can have far-reaching consequences,” Tucker said.
• Incident response planning. Ensure you have tested incident response and business continuity plans ready for ransomware attacks.
• Supply chain security. Evaluate and secure your supply chain, as threat actors often gain access through compromised third-party software.

For individuals:

• Never share credentials. Don't share passwords or verification codes, even if someone sounds official.
• Use strong, unique passwords. Implement different, complex passwords for critical accounts like banking and email.
• Enable MFA. Additionally, be cautious of fake prompts and use app-based authentication when possible.
• Verify independently. Call your bank or service provider directly using official numbers if something feels suspicious.
• Manage account settings. Set account lockout policies after a limited number of failed login attempts.

“The growth of this group–and others–serves as a stark reminder that today’s cybercrime has become a professional enterprise,” Tucker said. "Being prepared, having a cybersecurity playbook and robust programs, and investing in educating employees about the importance of cybersecurity safety will go far in protecting your business and clients.”