Profile of the Scattered Spider Threat Actor – Recent Strategies, Methods, Practices, and Indicators of Compromise.

Scattered Spider, also known as UNC3944, Octo Tempest, 0ktapus, Muddled Libra, and Scatter Swine, has evolved from basic phishing operations to sophisticated multi-stage ransomware campaigns targeting critical infrastructure. This cybercriminal group has transitioned to hypervisor-level attacks, particularly focusing on VMware vSphere and ESXi environments, which allows them to deploy ransomware directly from hypervisors. Their adoption of DragonForce ransomware in 2025, combined with their exceptional social engineering capabilities, has led to successful attacks against major retail chains, airlines, insurance companies, and critical infrastructure organisations in the United States and United Kingdom. The group’s tactics, as outlined by the MITRE ATT&CK framework, highlight their focus on credential access and initial access techniques, underscoring the urgent need for security professionals to address this escalating threat.

Emerging in May 2022, Scattered Spider consists primarily of native English-speaking young adults and teenagers based in the United States, United Kingdom, and Canada. The group is believed to be affiliated with a larger underground community known as “The Com” or “The Community,” which is linked to various criminal activities, including extortion, money laundering, cryptocurrency theft, and SIM swapping operations. Unlike traditional state-sponsored advanced persistent threats (APTs) or highly technical ransomware groups, Scattered Spider operates as a loose confederation of individual threat actors who collaborate through encrypted communication channels. This decentralised structure has proven remarkably resilient, enabling the group to continue its operations despite multiple high-profile arrests throughout 2024 and 2025. Their sophisticated understanding of Western business practices and exceptional social engineering skills allow them to convincingly impersonate employees and IT personnel during voice-based attacks.