In mid-September 2025, a message appeared on criminal channels announcing that Scattered Spider and more than a dozen allied groups, including members associated with LAPSUS$ and ShinyHunters, were “going dark.” Within days, researchers at ReliaQuest published details of a fresh Scattered Spider intrusion at a US financial institution. The retirement, if it was ever real, did not stop the attacks.
Scattered Spider matters less as a single gang than as a playbook. Its members, many of them young and English-speaking, have shown that the fastest way into a large enterprise is often not malware but a phone call to the help desk. That playbook is now widely copied, and it is supported by an industrial market in phishing kits and stolen credentials. Defending against it means hardening identity processes, not just identity technology.
A year of high-profile attacks
Scattered Spider, also tracked as UNC3944 and Octo Tempest, rose to prominence with the 2023 attacks on MGM Resorts and Caesars Entertainment. In 2025 it was linked to a run of disruptive intrusions: UK retailers Marks & Spencer and Co-op in the spring, followed by US insurers and airlines over the summer. CISA and the FBI updated their joint advisory on the group in July 2025, highlighting its help-desk impersonation, abuse of remote-access tools and deployment of ransomware in VMware environments.
Arrests followed. In September 2025 the UK’s National Crime Agency arrested two young men in connection with the 2024 cyberattack on Transport for London, and the US Department of Justice unsealed charges against one of them, alleging involvement in dozens of intrusions against US companies. Law enforcement pressure is real, but the techniques are cheap, well documented and easy for others to adopt.
Anatomy of the September 2025 bank intrusion
ReliaQuest’s account of the financial-sector attack is a compact tour of the group’s methods:
- The attackers socially engineered access to a senior executive’s account and reset its password through Azure Active Directory (now Microsoft Entra ID) self-service password reset.
- They read internal IT and security documentation to learn the environment.
- They moved through the Citrix environment and VPN, then compromised VMware ESXi infrastructure to harvest more credentials.
- They reset a Veeam backup service account password and granted themselves Azure Global Administrator rights.
- They relocated virtual machines to evade detection and attempted to pull data from Snowflake and AWS.
Almost none of this required an exploit. It relied on identity workflows designed for convenience, and on administrative access to the systems, such as hypervisors and backup platforms, that underpin everything else. Self-service password reset deserves particular attention. It exists to take routine load off the help desk, and most organizations configure it with whatever verification methods are easiest for users, such as a text message code or security questions. Those methods can be defeated by SIM swapping, by answers found on social media, or simply by talking an employee into reading out a code. When the account being reset belongs to an executive or administrator, a single weak reset path undoes every other control around that identity. For how quickly this kind of movement happens, see ultra-fast network intrusions.
The phishing economy behind it
Scattered Spider’s social engineering sits on top of a wider phishing-as-a-service market. Subscription kits provide ready-made fake login pages for Microsoft 365, Okta and other identity providers, often with adversary-in-the-middle proxies that capture both the password and the MFA session. Anyone can rent them.
In September 2025 Microsoft’s Digital Crimes Unit, working with Cloudflare, seized 338 websites tied to RaccoonO365, a fast-growing subscription service used to steal Microsoft 365 credentials. Takedowns like this raise costs for criminals, but new kits appear quickly. The practical lesson is that credential phishing is now a commodity, and identity controls must assume some users will be fooled. We look at the credential market more broadly in Credential and identity theft is reaching crisis levels.
Hardening identity workflows against Scattered Spider
- Make help-desk verification strong and consistent. Never reset passwords or MFA based on information an attacker could find or buy, such as employee ID numbers or dates of birth. Use video verification against an ID on file, a callback to a number already in the HR system, or approval from the user’s manager through a separate channel. Apply the strictest rules to executives and administrators, who are the most targeted.
- Tighten self-service password reset. Require phishing-resistant methods for SSPR in Entra ID, exclude privileged accounts from self-service reset, and alert on resets followed by new MFA registrations or sign-ins from new locations.
- Adopt phishing-resistant MFA. Passkeys and FIDO2 keys defeat adversary-in-the-middle phishing kits. Start with administrators, executives and help-desk staff.
- Protect the infrastructure layer. Separate administrative accounts for vCenter, ESXi, backup platforms and cloud consoles from everyday identities, require MFA on them, and monitor for new Global Administrator assignments and backup configuration changes.
- Keep threat intelligence current. Block newly registered look-alike domains of your brand and identity provider, and subscribe to feeds that track phishing kit infrastructure.
- Train for the real scenario. Teach staff, especially the help desk, that urgency, seniority and insider knowledge on a call are not proof of identity, and that following the verification script is always the right answer.
The trade-off is service speed. Stronger verification makes some legitimate resets take longer, and executives may complain. Set expectations with leadership in advance. Our cybersecurity and compliance services include help-desk and identity process reviews, and our article on how social engineering has evolved covers the human side.
Frequently asked questions
Should we believe ransomware groups when they announce retirement?
No. Retirements are often a response to law enforcement pressure and are frequently followed by rebranding or continued activity under other names. Plan defenses around techniques, not group names.
Which industries does Scattered Spider target?
It has hit hospitality, retail, insurance, airlines, technology and financial services, and it tends to focus on one sector at a time. Healthcare and any organization with a large, outsourced help desk share the same exposure.
What is the single most effective control?
Strong identity verification at the help desk combined with phishing-resistant MFA. Together they close the two doors this group most often walks through. After that, protect the hypervisors and backup systems, because they decide whether an intrusion becomes a costly outage or a contained incident. Test both controls with a realistic exercise, such as a simulated help-desk call from a “locked-out executive.”
Closing the identity gap
Delana Technologies helps organizations harden help-desk procedures, Entra ID and Okta configurations, and administrative access to the infrastructure attackers target. To review your exposure to social-engineering attacks, call 239.414.5126 or contact us.
Sources: ReliaQuest research on Scattered Spider’s financial-sector activity (September 2025); The Hacker News and The Register coverage (September 2025); CISA and FBI joint advisory AA23-320A on Scattered Spider (updated July 2025); UK National Crime Agency and US Department of Justice announcements on arrests and charges (September 2025); Microsoft On the Issues, “Microsoft seizes 338 websites to disrupt rapidly growing RaccoonO365 phishing service” (September 16, 2025).