3 key takeaways from the Scattered Spider attacks on insurance firms

Scattered Spider, active since 2022, has executed a series of high‑impact identity‑based attacks through 2023–2025—targeting insurers and major retailers—by abusing help‑desk processes, bypassing MFA (SIM swap, MFA fatigue, AiTM phishing), stealing cloud data, and deploying ransomware via VMware environments; the report analyzes these TTPs, outlines the growing trend of identity attacks, and recommends Push Security’s browser‑based protections as mitigation.