Tracking Adversaries: Scattered Spider, the BlackCat affiliate

This analysis describes OSINT and technical overlaps suggesting the English-speaking Scattered Spider group has begun collaborating with or operating as an affiliate of the BlackCat (ALPHV) ransomware ecosystem. It highlights Scattered Spider’s credential-harvesting social-engineering methods (SMS phishing, vishing, MFA fatigue, SIM swap), use of commercial RMM tools and defense-evasion techniques (Microsoft-signed malicious drivers, BYOVD, UEFI BlackLotus), and links these TTPs and IOCs to data theft/ransom incidents such as the Reddit and Riot Games intrusions, concluding the group may have shifted tactics toward ransomware campaigns.