Scattered Spider
Threat Actor
Scattered Spider threat actors, per trusted third parties, have typically engaged in data theft for extortion. Known to utilize BlackCat/ALPHV ransomware alongside their usual TTPs.
This loose-knit group of predominantly teenage, native English-speaking hackers has carried out some of the most disastrous cyberattacks in history, such as MGM Hotels and Transport for London.
Incidents Associated with this Threat
- August 8, 2025: Massive Cyberattack Hits Salesforce Affecting 760 Companies
- June 5, 2025: Cyberattack at United Natural Foods Inc. (UNFI) Causes Widespread Disruption and Shutdown
- September 2, 2024: Systems Breached at Transport for London (TfL) HQ
- September 8, 2023: MGM Shuts Down Operations for 10 Days Across Las Vegas Properties
Malware Used by this Threat Actor
No malware identified for this threat actor.