Microsoft links Scattered Spider hackers to Qilin ransomware attacks

### Executive summary Microsoft reports that the financially motivated group Scattered Spider (Octo Tempest/0ktapus) has begun deploying Qilin ransomware in its campaigns; the group uses social-engineering TTPs (IT impersonation, phishing, MFA bombing, SIM swapping) to obtain admin access, exfiltrate data for double-extortion, and deploy an advanced Linux/VMware ESXi encryptor. Qilin has claimed over 130 victims and been linked to disruptive incidents affecting organizations including NHS hospitals and Synnovis, with ransom demands ranging from tens of thousands to millions.