The FBI wrote down the Scattered Spider playbook, and it starts with a phone call by Lucie Cardiet

This report reviews a 35‑page federal complaint alleging that Scattered Spider (aka Octo Tempest) used social‑engineering help‑desk calls to reset credentials and MFA, then escalated privileges, installed legitimate tunneling tools (ngrok, Teleport.sh), and exfiltrated at least 77 GB of data to Amazon S3 before attempting ransomware extortion; the complaint links the activity to more than 100 network compromises and over $100M in ransom payments and illustrates detection gaps caused by post‑authentication abuse of legitimate tools and processes.