Scattered Spider has become one of the most concerning cyber threats to watch in 2025. Unlike traditional ransomware operators that exploit technical vulnerabilities, this group primarily bypasses security by targeting people. Their attacks often start with something as simple, and as dangerous, as a phone call. Members of Scattered Spider typically impersonate employees, calling help desks to convince staff to reset MFA or issue password changes. This lets them step neatly around complex security controls. What makes them especially formidable is their speed: once inside, they escalate privileges, locate sensitive data and can deploy ransomware within hours.

A Modern, Agile Adversary

Most of this group’s operators are young, English-speaking recruits who coordinate through gaming channels like Discord. They’re quick to spin up new phishing kits or malicious infrastructure, and they understand cloud environments intimately.

Tactics like “golden SAML,” SIM-swapping and manipulating Azure are now standard parts of their toolkit, giving them a clear advantage over defenses built mainly for older, on-premise attack models.

The impacts have been significant. In the UK, brands like Marks & Spencer and Harrods have been hit. In Australia, Qantas suffered a breach through its outsourced contact center, exposing data from more than six million customers. In the US, casinos like MGM Resorts and Caesars faced multi-week operational disruptions and hundreds of millions in combined losses.

These breaches show that the real risk extends beyond IT infrastructure. It reaches deep into customer confidence, brand reputation and financial stability.

Why Traditional Detection Falls Short

No EDR, firewall or endpoint stack can stop an employee from handing over credentials. That’s why traditional security tools often fail to catch social engineering. The indicators are subtle: repeated MFA resets, strange login patterns and unusual vendor connections, signals scattered across logs and often overlooked by stretched teams. For cyber threat intelligence teams, SOC leads and CISOs, the question is how to connect these small dots before they become major incidents.

How Protos AI Helps

Scattered Spider is a clear example of adversaries coming through your vendors and staff: it reaches organizations through their staff, their help desks and the outsourced vendors around them, not through their code.

Protos AI delivers Adversary Risk Intelligence: intelligence directed by what your organization needs to protect. It works in four steps.

• Understand what you need to protect. We identify what must keep running, what supports it and the questions your team needs answered. Against a group like Scattered Spider, that includes the help desks, identity providers and outsourced vendors it targets.
• Collect. We collect from sources relevant to your questions, including code repositories, vendor disclosures, forums, social media and others.
• Analyze. We interpret the findings, using local cultural knowledge where needed, and assess what the activity could mean for your organization.
• Verify (optional hunting). For engagements that include hunting, we investigate data you choose to share — from telemetry and logs to onboarding records, transactions and bank statements. For social engineering, that means looking for MFA resets, unusual help desk activity and access anomalies linked to known tactics. Relevant findings are watchlisted for changes in adversary methods.

Every conclusion comes with its sources and reasoning, and your team stays in control. We never block or remediate: we tell you whether you are exposed, and your team decides and acts.

Looking Ahead

Scattered Spider targets people and the vendors around them, not just systems. To find out whether you are exposed, start with a 4-week proof-of-concept on one live use case. Every POC is built on your own workflows, playbooks and data sources, with success criteria agreed at kickoff.