Exploiting the Human Layer: Scattered Spider’s Identity-Centric Attack Chain (2022–2025)

Scattered Spider (UNC3944) is a financially motivated adversary that has progressed from providing initial access to performing full intrusion chains—using sophisticated social engineering to bypass MFA, conducting AD and SaaS reconnaissance, exfiltrating data to remote S3 buckets, and deploying DragonForce ransomware against large enterprises across North America, Europe and APAC; the report maps observed TTPs to MITRE ATT&CK and offers mitigation guidance.