How Scattered Spider hackers are wreaking havoc on corporate America
Add Axios as your preferred source to
see more of our stories on Google.
Illustration: Aïda Amer/Axios
A persistent hacking crew of young men and teenagers is back with a vengeance, wielding a two-year-old playbook to knock U.S. corporate systems offline.
Why it matters: Scattered Spider hasn't had to evolve much to remain effective — a sign of how little corporate cybersecurity defenses have improved.
- The group's tactics, including help desk impersonation and SIM swapping, continue to wreak havoc across critical industries.
Driving the news: Over the past month, Scattered Spider has been on a hacking spree that's disrupted operations at retailers, grocery chains, insurance providers, and airlines across the U.S., the U.K. and Canada.
- Their reach may also now extend into Australia, where Qantas is investigating a cyberattack on one of its call centers — a hallmark tactic of Scattered Spider.
The big picture: Unlike most ransomware gangs, Scattered Spider isn't a monolithic, state-sponsored machine. It's a loose collective, largely made up of teenagers and young men who emerged from online gaming communities like Roblox and Minecraft.
- "Scattered Spider includes more people in Western countries than other ransomware groups," Cynthia Kaiser, senior vice president of Halcyon's Ransomware Research Center and a former top FBI cyber official, told Axios.
- But while originally rooted in English-speaking countries, it's evolved into a more global operation, she said.
Breaking it down: The group operates like a business, with a leadership structure, junior associates and temporary roles. Some members' sole job is to call help desks and reset employee passwords.
- Adam Meyers, SVP of counter adversary operations at CrowdStrike, told Axios the group's origin lies in a toxic subset of gaming culture, where online harassment evolved into SIM swapping and eventually ransomware.
- Scattered Spider's core includes about four leaders, but its operations are interwoven with members of the broader online community "The Com," which has ties to cybercrime and real-world violence, experts said.
How it works: The group's primary tactic remains voice-based phishing where they call a company's overseas help desk, impersonate an employee, and reset their single sign-on passwords.
- They then use SIM swapping to intercept multifactor-authentication codes.
- In recent incidents, the group has escalated attacks by targeting ESXi hypervisors — systems that power a company's servers and digital operations but often fly under the radar of traditional security tools. Once inside, they deploy ransomware and cripple the server environment.
- "They're ninjas with identity," Meyers said. "They know how to avoid modern security tools ... and they're incredibly fast — in some cases, there's less than 24 hours between gaining access to deploying ransomware."
- Meyers added that his team has identified seven unique voices calling help desks in recent months.
Flashback: Scattered Spider first made headlines in 2023 with attacks on Las Vegas casinos, including MGM Resorts and Caesars Entertainment. Two years later, their methods remain largely unchanged.
- "It's largely the same, frankly," Meyers said. "Once they figure out one organization that they can successfully get into, then they go, 'We're here, who are their peers, who are their competitors, who else is there that we can perhaps go after?'"
Threat level: Scattered Spider is now collaborating with Russian ransomware gangs, including those behind Play, Akira and DragonForce, Kaiser said.
Between the lines: Despite the group's Western presence, law enforcement faces obstacles in tracking them down.
- Many members are minors, which gives them different legal protections, Meyers said. And if they have any mental health conditions, officials in some countries where the group operates are limited in how long they can hold them and what charges they can pursue.
- For instance, when authorities arrested members of the Lapsus$ hacking gang — another group involving juvenile offenders — prosecutors struggled to proceed against a 17-year-old despite clear evidence of major corporate breaches.
- Kaiser noted that identifying every member of Scattered Spider is difficult due to the group's sprawling, decentralized nature.
The intrigue: Still, U.S. officials have made more arrests tied to Scattered Spider than to Russian ransomware crews. In November, five men were charged in connection with the group.
The bottom line: Experts urge U.S. companies to implement strict ID verification protocols at IT help desks and to upgrade outdated MFA methods like SMS and voice codes.
- They should also closely monitor how much network access is granted to third-party vendors.
