Scattered Spider’s Structure More Like a Cybercrime Collective Than a Unified Gang

Group-IB's analysis reframes Scattered Spider as a decentralized collective of independent clusters that share social-engineering-centric tactics (phishing of identity providers, SIM swapping, insider recruitment, use of remote access tools) to enable cryptocurrency fraud, enterprise compromises, extortion and ransomware; activity has persisted across high-profile incidents despite arrests, so defenders should prioritize mitigating identity-based attacks and social engineering.