The Rise and Fall of the ‘Scattered Spider’ Gang

After eluding capture for more than two years following a hacking spree that targeted some of the world’s biggest technology companies, US authorities say they have finally caught at least some of the criminals.

In August 2022, security researchers went public with a warning that a group of hackers had targeted more than 130 organizations as part of a phishing campaign that stole the information of nearly 10,000 employees. The hackers specifically targeted companies that use Okta, a single sign-on provider used by thousands of companies around the world to allow their employees to sign in from home.

Because of the focus on Okta, the hacker group was named “0ktapus.” So far, the group has hacked Caesars Entertainment, Coinbase, DoorDash, Mailchimp, Riot Games, Twilio (twice), and many more.

The most notable cyberattack by hackers due to downtime and impact was the MGM Resorts hack in September 2023, which reportedly cost the casino and hotel giant at least $100 million. In that case, the hackers worked with the Russian-speaking ransomware group ALPHV, and demanded a ransom from MGM to get the company’s files. The hack was so disruptive that MGM-owned casinos had trouble providing services for days.

For the past two years, as law enforcement has been cracking down on criminals, people in the cybersecurity industry have been trying to figure out how to classify hackers and whether they should be placed in one group or another.

Hacker methods, such as social engineering, email and text phishing, and SIM swapping, are common and widespread. Some of the hackers were part of several groups responsible for different data breaches. These conditions made it difficult to understand exactly who was in which group. Cybersecurity giant CrowdStrike has dubbed this umbrella group of hackers “Scattered Spider,” and researchers believe there is some overlap with 0ktapus.

The group has been so active – and successful – that CISA and the US FBI issued an advisory in late 2023 detailing the group’s activities and strategies, in an effort to help organizations prepare and defend against anticipated attacks.

Scattered Spider is “a group of cybercriminals targeting large corporations and their contracted IT help desks,” CISA wrote in its advisory. The agency warned that the group “often engages in data theft for fraud,” and noted their known links to ransomware gangs.

One thing that is relatively certain is that the hackers are mostly English-speaking, and are widely believed to be in their young and early 20s – and are sometimes referred to as “persistent youth.”

“There is a limited number of children involved, and that is because this group deliberately recruits children because of the soft legal status these children are in and they know that nothing will happen to them if the police catch the child,” Allison Nixon, a research officer. in Unit 221B, he told TechCrunch at the time.

Over the past two years, some members of 0ktapus and Scattered Spider have been linked to the same nefarious group of cybercriminals known as “Com.” People in this vast cyber crime community have committed extreme crimes in the real world. Some of them are the ones who commit acts of violence, such as robbery, burglary, and brickbatting – hiring criminals to throw bricks at someone’s house or house; and swiping – when someone tricks authorities into believing a violent crime is taking place, prompting an armed police force to intervene. While born as a prank, swatting has been known to have deadly consequences.

After two years of hacking, authorities are finally starting to identify and charge Scattered Spider members.

In July, UK police confirmed the arrest of a 17-year-old boy in connection with the MGM robbery.

In November, the United States Department of Justice announced that it had indicted five criminals: Ahmed Hossam Eldin Elbadawy, 23, of College Station, Texas; Noah Michael Urban, 20, of Palm Coast, Florida, who was arrested in January; Evans Onyeaka Osiebo, 20, of Dallas, Texas; Joel Martin Evans, 25, of Jacksonville, North Carolina; and Tyler Robert Buchanan, 22, of the United Kingdom, who was arrested in June in Spain.