Connecting Scattered Spider: Defining A Cybercrime Collective Through Shared TTPs

Group-IB presents Scattered Spider as a decentralized cybercrime movement composed of small independent subclusters that conduct high-impact operations—SSO/Okta phishing, vishing/smishing, SIM swapping, crypto theft (P1 bots/drainer sites), and facilitate ransomware/extortion—targeting telcos, marketing platforms, crypto users, enterprises and BPOs; the report details observed TTPs (phishing kits, RATs, VoIP abuse, lookup services), notable incidents, attribution challenges, and practical mitigations (FIDO2, threat intelligence, URL vigilance).