Scattered Spider hackers switch focus to cloud apps for data theft

The report describes Scattered Spider (UNC3944/Octo Tempest), a loose criminal collective that has shifted from on-premises account hijacking to targeting cloud infrastructure and SaaS applications for data-theft extortion. Using social engineering against help-desk agents and Okta account abuse, the actor escalates privileges, creates persistent VMs, disables security telemetry, deploys credential-theft and lateral-movement tools, and exfiltrates data via legitimate cloud-sync services to GCP/AWS; the report includes defensive recommendations such as centralized SaaS logging, monitoring MFA re-registrations, and tighter access policies.