Scattered Spider, BlackCat claw their way back from criminal underground

The article describes the reemergence of organized ransomware groups (Scattered Spider and BlackCat/ALPHV and affiliated crews) conducting high-impact social-engineering-driven intrusions using new tooling (RansomHub/Cicada), defensive-evasion techniques (ESXi VM persistence, credential dumping) and extortion via Microsoft Teams; it highlights large-scale impact (Change Healthcare breach affecting millions), law enforcement actions, and stresses that these decentralized criminal operations remain active and evasive while defenders should harden help-desk controls, MFA bypass protections, endpoint and network monitoring.