Scattered Spider
A native English-speaking cybercrime group that talks its way past help desks and MFA, then steals data and deploys ransomware. UK law enforcement has severely disrupted it, but the methods it made famous remain a live risk.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters to UK Organisations
The clearest UK example is Transport for London. Between 31 August and 3 September 2024, two men the National Crime Agency describes as leading members of Scattered Spider gained unauthorised access to its network. TfL reported £29 million in losses and recovery costs, 148 systems became inoperable, and all 27,000 staff had to attend an office for a password reset. On 16 July 2026, each was sentenced to five years and six months in prison.3
The group was also widely linked to the attacks on Marks & Spencer, Co-op and Harrods in spring 2025. The NCSC said in May 2025 that it had not yet determined whether those incidents were connected, but told organisations to review how their help desks verify people before resetting passwords.4 Four people were arrested in July 2025 on suspicion of offences including Computer Misuse Act breaches and blackmail.5 Arrests are not convictions, so we treat that attribution as reported rather than proven.
The target list goes well beyond retail. MITRE records early targeting of customer relationship management providers, outsourcing firms, telecoms and technology companies, expanding in 2023 to gaming, hospitality, retail, managed service providers, manufacturing and financial services.1
The NCA says its action effectively halted the group's activity and severely disrupted the threat, while warning that other criminals may still use the name.3 The group has been described as amorphous, with members who come and go.6 We would plan on the basis that the group's brand is damaged but its methods are not. They rely on a convincing phone call rather than rare technical skill, so other criminals can reuse them.
How It Attacks
Based on the joint advisory from the FBI, CISA, the UK's NCSC and international partners.2 Attackers change their methods often, so treat this as a typical pattern and not a fixed script.
- 1
Research the Target
Buys credentials on criminal marketplaces, gathers personal data and studies roles on company websites and social media. Registers lookalike domains and creates fake social media profiles.
- 2
Get In Through People
Poses as IT staff to employees, or as employees to the help desk. Uses phone calls, SMS and phishing, repeated MFA prompts and SIM swaps. May call several times to learn the reset process first.
- 3
Take Over the Identity
Moves MFA to a device it controls, registers its own tokens and creates new accounts. Has also added its own identity provider to a victim's single sign-on tenant.
- 4
Stay Hidden
Installs legitimate remote access tools, backs new identities with fake social profiles, and uses proxy networks and rotating machine names.
- 5
Find What Matters
Searches SharePoint, credential documents, VMware vCenter, backups, VPN instructions and Active Directory, then moves across cloud instances.
- 6
Watch the Defenders
Reads Slack, Microsoft Teams and Exchange Online for signs of detection, and has joined incident response calls.
- 7
Steal, Encrypt and Extort
Takes data to services such as MEGA and Amazon S3, may deploy DragonForce ransomware including on VMware ESXi, then demands payment.
Key Techniques
Selected from the group's ATT&CK v20 entry.1 ATT&CK lists many more, and a technique can sit under more than one tactic.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1598.004 | Spearphishing Voice | Reconnaissance | Calls the help desk and employees to obtain credentials and codes. |
| T1684.001 | Impersonation | Stealth | Persuades IT help desk staff to reset passwords and MFA tokens. |
| T1621 | MFA Request Generation | Credential Access | Sends repeated prompts until someone approves one. |
| T1556.006 | Multi-Factor Authentication | Persistence | Registers its own MFA tokens on compromised accounts. |
| T1484.002 | Trust Modification | Privilege Escalation | Adds a federated identity provider to the victim's SSO tenant. |
| T1219.002 | Remote Desktop Software | Command and Control | Deploys commercial remote access tools, or tells victims to run them. |
| T1003.003 | NTDS | Credential Access | Extracts NTDS.dit using shadow copies of virtual domain controller disks. |
| T1213.005 | Messaging Applications | Collection | Searches Slack and Teams for discussion of the intrusion and response. |
| T1567.002 | Exfiltration to Cloud Storage | Exfiltration | Sends stolen data to MEGA, Snowflake and Amazon S3. |
| T1486 | Data Encrypted for Impact | Impact | Has used BlackCat and DragonForce ransomware. |
Tools Observed
Remote Access and Tunnelling
Malware and Credential Theft
Ransomware
Tool lists come from the joint advisory and ATT&CK.2,1 Many are legitimate products, so finding one does not prove compromise. Check whether it is approved and expected.
Vulnerabilities
Software flaws are not the main story here. The joint advisory does not name a CVE as a way in.2 ATT&CK records this one, used to load a malicious kernel driver after access:1
Patching still matters, but it will not stop a convincing phone call.
Key Events
Active from at least this year, initially focused on CRM and outsourcing providers, telecoms and technology companies.1
Expands into gaming, hospitality, retail, managed service providers, manufacturing and financial services.1
The FBI and CISA publish their first joint advisory on the group.2
Attack on Transport for London.3
Attacks on major UK retailers, widely linked to the group. The NCSC publishes advice for organisations on 4 May.4
Four arrests in the retail investigation.5 The joint advisory is updated on 29 July with NCSC-UK as a co-author, adding DragonForce and new help desk techniques.2
Two men sentenced over the TfL attack. The NCA says the threat has been severely disrupted.3
Warning Signs
Drawn from NCSC guidance, the joint advisory and ATT&CK.4,2,1 None of these proves an attack alone, but each deserves a quick check.
- A new MFA device registered soon after a help desk reset
- Risky logins, or logins from unusual sources such as residential VPN ranges
- A new federated identity provider or changed conditional access policy
- Unapproved remote access or tunnelling tools on endpoints or vCenter
- Inbox rules that delete or hide security alerts
- A sudden burst of queries against Snowflake or other data stores
- Unexpected activity on Domain, Enterprise or Cloud Admin accounts
- Lookalike domains using your name with terms such as helpdesk or SSO
Defences That Matter
Secure the Help Desk
- Review how staff verify people before resetting passwords or MFA, with extra checks for privileged accounts.4
- Call back on a number held on file and never on one given by the caller.
- Train help desk staff using realistic vishing scenarios.2
Harden Identity
- Use FIDO/WebAuthn or PKI-based MFA, which resists push bombing and SIM swaps.2
- Prioritise webmail, VPNs and accounts with access to critical systems.2
- Check that Domain, Enterprise and Cloud Admin access is legitimate.4
Detect the Quiet Moves
- Monitor risky logins and atypical sources.4
- Allowlist applications, including remote access programs, and audit what is installed.2
- Use EDR and network monitoring to spot lateral movement.2
Plan for the Worst Day
- Keep offline, encrypted, immutable backups and test recovery.2
- Have a way to run the response outside Slack, Teams and corporate email, as this group watches them.
- Test the plan against these techniques, including ESXi loss.2
Could a Phone Call Beat Your Help Desk?
We can test your help desk and identity controls using the methods in this profile, and then help you close the gaps.
Sources
- MITRE ATT&CK: Scattered Spider (G1015), group version 3.0, ATT&CK v20
- FBI, CISA, NCSC-UK and partners: Scattered Spider advisory AA23-320A, updated 29 July 2025
- National Crime Agency: Two sentenced for hacking Transport for London, 16 July 2026
- NCSC: Incidents impacting retailers, recommendations from the NCSC, 4 May 2025
- CyberScoop: UK arrests four for cyberattacks on major British retailers, 10 July 2025
- TechCrunch: UK cops say arrest of two young hackers disrupted the operations of an infamous hacking group, 16 July 2026
- CISA Known Exploited Vulnerabilities catalogue, version 2026.10.30
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.