Loading story…
FBI Cyber Division Assistant Director Bryan Vorndran estimated in May 2024 that Scattered Spider comprised approximately 1,000 people in a dispersed network associated with the online criminal community known as “the Com.” Members are predominantly native English speakers, largely based in the United States and United Kingdom. Scattered Spider has breached major companies including MGM Resorts and Clorox. Its tactics include manipulating help desks to obtain privileged access, moving through corporate networks, stealing data, and sometimes collaborating with ransomware groups. Some groups within the broader Com also use physical threats to support extortion.
Separately, KrebsOnSecurity reported that a Florida man charged in a SIM-swapping spree was a key suspect linked to Oktapus and Scattered Spider; that reporting does not establish a conviction. The FBI said it had taken investigative actions that were not publicly disclosed. CyberScoop also clarified that Scattered Spider targeted Okta customers for identity credentials, while Okta said the group had not breached Okta itself. The reported tactics underscore the need for strong help-desk identity verification, hardened account-recovery procedures, phishing-resistant authentication, and monitoring of privileged-access changes.
Get the infrastructure and lures behind it.
8 events from the most recent confirmed update back to the earliest known activity.
Microsoft reported that some groups within the Com used physical threats against victims to pressure them into paying extortion demands.
CyberScoop withdrew an earlier claim that Scattered Spider had breached Okta. The correction clarified that the group targeted Okta customers for identity credentials, while Okta said the company itself had not been breached by the group.
Responding to criticism over an apparent lack of arrests, FBI officials said the agency had taken non-public actions against Com members and promised further action.
At Sleuthcon, FBI Cyber Division Assistant Director Bryan Vorndran described Scattered Spider as a dispersed network of approximately 1,000 people. He ranked it among the top three cybersecurity threats alongside China and Russia's foreign intelligence agency.
Florida authorities arrested 19-year-old Noah Urban in January. Krebs on Security identified him as a key suspect in Oktapus and Scattered Spider and reported charges connected to a SIM-swapping spree.
Scattered Spider breached Clorox, which was identified among the group's major corporate victims.
Members of the Com were linked to an attack on Caesars Entertainment, among attacks that disrupted casino and hotel operations in Las Vegas.
Scattered Spider breached MGM Resorts. Members of the broader criminal community known as the Com were linked to the attack, which disrupted casino and hotel operations in Las Vegas.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
cyberscoop.com
Open sourcekrebsonsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Group-IB reported that **Scattered Spider** is better understood as a decentralized cybercrime collective rather than a single, tightly organized threat group. The company said multiple small, independent subclusters share tactics, tools, and social-engineering tradecraft, including phishing pages impersonating **Okta** and other identity providers, along with **vishing**, **smishing**, **SIM swapping**, and remote-access tooling to gain access to enterprise environments. The report linked these subclusters to intrusions affecting telecoms, marketing and communications providers, enterprises, cryptocurrency users and firms, BPOs, and support organizations, and associated the broader ecosystem with incidents involving **Twilio** customers, **Riot Games**, **MGM**, **Caesars**, **Co-op**, and **Marks & Spencer**. Group-IB also highlighted overlap with aliases including **0ktapus**, **UNC3944**, **Muddled Libra**, and **Octo Tempest**, warning that arrests of individual actors are unlikely to dismantle the threat because separate operators can continue working independently.
Aug 11, 2026
U.S. prosecutors unsealed charges against five men allegedly linked to the **Scattered Spider** cybercrime ecosystem, accusing them of running a large-scale scheme that used SMS phishing, spoofed login pages, social engineering, stolen employee credentials, email hijacking, and SIM swapping to compromise companies and individuals. Court filings say the operation targeted technical employees across the United States between September 2021 and April 2023, enabling the theft of non-public corporate data, personal identifiers, and **millions of dollars in cryptocurrency**. Four suspects were charged in the United States with conspiracy to commit wire fraud, while a separate complaint was filed against a fifth defendant in the United Kingdom. The case adds to mounting law-enforcement scrutiny of Scattered Spider, a loose English-speaking threat actor network also tracked under multiple aliases and associated with the broader **"Com"** ecosystem. Authorities and researchers have linked the group to high-profile intrusions and collaborations with ransomware operations including **BlackCat/ALPHV**, **Qilin**, and **RansomHub**, as well as incidents affecting MGM Resorts, Clorox, Snowflake-linked victims, and later investigations into the hacks at **Marks & Spencer** and **Co-op**. The charges mark a significant escalation in efforts to disrupt a group known for blending phishing, identity takeover, and extortion-focused intrusion tactics.
Jun 29, 2026
MGM Resorts and Caesars Entertainment were hit in closely timed cyberattacks that investigators and security firms tied to the **Scattered Spider** criminal community, a loose English-speaking group known for social engineering, SIM swapping, phishing, and MFA fatigue. Caesars disclosed that attackers stole customer data and reportedly paid a ransom demand, while MGM suffered a far more disruptive intrusion that knocked hotel and casino operations offline for days and was later estimated to have cost about **$100 million**. Multiple reports said the intrusions involved help-desk impersonation and other employee-targeting tactics, with Scattered Spider affiliates also linked to ransomware operators including **BlackCat/ALPHV**. The fallout expanded beyond the initial breaches as Caesars sent breach notifications to thousands of affected people and both casino companies faced lawsuits and class actions alleging failures to protect personal information. Law enforcement pressure then intensified: investigators in the US, UK, and Spain pursued suspected Scattered Spider members, including a 22-year-old British man arrested in Spain as an alleged leader and a 17-year-old arrested in the UK over the MGM attack, with additional US arrests and prosecutors reportedly moving closer to charges. Security researchers said the Las Vegas casino intrusions put a bullseye on the group, which had evolved from SIM-swapping into ransomware, extortion, and cloud-focused intrusions against major enterprises.
Jun 29, 2026