From “Oktapus” to Infrastructure Ransom: The Rise of a Predator

Spring 2022. Targeted phishing campaigns against Okta employees flooded CERT timelines: the infamous “Oktapus” campaign set the stage. Very quickly, targets expanded to telecom operators and BPOs — ideal leverage points to bypass authentication and infiltrate entire ecosystems.

By 2023, the group had fully transitioned into extortion and Ransomware-as-a-Service (RaaS) operations, with several cases now considered textbook incidents: MGM Resorts and Caesars Entertainment. The numbers speak for themselves: MGM estimated losses of >$100M, while Caesars reportedly paid ≈$15M to prevent data disclosure.

2024 marked a massive entry into retail: Marks & Spencer reported an estimated ≈£300M operational impact, an extraordinarily rare figure for such a historical player. The arrests of very young profiles in the UK and the US did nothing to slow the group down: Scattered Spider is a networked swarm, not a single cell.

2025: The Sky Darkens — A Strategic Shift to Aviation

By early summer 2025, the FBI and multiple private-sector players raised the alarm: the group shifted focus to aviation — a domain where business continuity is critical and third-party dependencies are abundant. Incidents struck WestJet (June 13) and Hawaiian Airlines (late June); both are still in remediation, with specialists and forensic responders attributing the attacks to Scattered Spider. Signals are also emerging around Qantas. For SOC teams, the takeaway is clear: this is a cross-sector, rapidly adaptive threat with kill chains that evade endpoint telemetry once they reach ESXi hypervisors (VMware virtualization platforms managing multiple virtual machines — compromising ESXi provides full control over servers and hosted workloads).

Anatomy of an Intrusion: Zero-Doubt Before Zero-Day

Their reconnaissance phase is meticulous: org charts, naming conventions, helpdesk workflows, SaaS footprints, even the presence of an IdP (Okta / Entra / OneLogin). The initial blow targets identity: pixel-perfect cloned SSO portals, typo-squatted domains embedding keywords like okta, sso, helpdesk, or internal, combined with smishing and vishing designed to impersonate IT support. The goal: steal credentials and bypass MFA through fatigue attacks (push bombing), SIM-swapping (impersonating the victim to their mobile carrier to hijack their phone number and intercept MFA codes), or enrolling a new MFA device by abusing the helpdesk.

Once inside, the group thrives in the environment: using legitimate RMM tools (Remote Monitoring & Management — software like AnyDesk, TeamViewer, or ScreenConnect, designed for IT support but abused here to maintain stealthy persistence), executing commands via RDP / SSH / PsExec (RDP: Remote Desktop Protocol for Windows control, SSH: Secure Shell for secure server access, PsExec: Microsoft tool for executing remote commands, often used for lateral movement), and leveraging Mimikatz / LSASS / DCSync (Mimikatz: credential-dumping tool, LSASS: Windows process where authentication tokens are stored, DCSync: a method for impersonating an Active Directory domain controller to extract all stored credentials) to escalate into full Active Directory dominance.

The most devastating campaigns then pivot into vCenter / VCSA (VMware’s centralized administration console for ESXi hypervisors) and directly into ESXi, where hypervisor-level encryption and backup sabotage double their leverage: few endpoint IoCs, massive impact.

Beyond the Exploit: The Extortion Economy

The final payload matters less than the theater around it. Depending on the opportunity, Scattered Spider affiliates with major RaaS operators — ALPHV / BlackCat, RansomHub, Qilin, DragonForce — orchestrating double extortion: encryption plus the threat of public data leaks. In several campaigns, the group actively manipulates public opinion via Telegram and Discord to amplify reputational pressure.

By mid-2025, multiple intelligence reports highlighted possible connections with LAPSUS$ and ShinyHunters. For CISOs and CTI teams, the real takeaway isn’t the label but the constant: monetizing compromised identity at scale.

Why They Win: Process vs. Process

Scattered Spider’s edge doesn’t come from exotic zero-days; it comes from a surgical understanding of your own processes: how your helpdesk validates password resets, who approves MFA device enrollment, and what operational exceptions are tolerated “to restore service quickly.”

Every operational tolerance becomes an intrusion vector. When your EDR perfectly secures endpoints, they shift the battle above the kernel: vulnerable drivers (BYOVD), hypervisors, cloud IdPs, and backup chains. They don’t look for a backdoor — they become the operator your procedures are designed to trust.

The True Cost: Numbers Matter, but Days Matter More

MGM and Caesars served as a wake-up call for the hospitality and leisure industry. In 2025, Marks & Spencer estimated an impact of ≈£300M on operational results, with 15 weeks required to fully restore their “click-and-collect” services.
In aviation, even without a safety incident, every hour of downtime disrupts flight operations, damages customer relationships, and increases ransom pressure. In almost every case, time — not just ransom size — bleeds companies dry.

Moving to Defensive Offense: Three Critical Workstreams in 90 Days

Identity & Helpdesk Hardening. Regain control over sensitive changes: no privileged account resets or MFA device enrollments without out-of-band dual verification and strong proof-of-possession. Where possible, eliminate SMS OTP in favor of FIDO2/WebAuthn keys or number-matching MFA. Equip SOC teams to monitor IdP signals (MFA enrollments, new IdPs, repeated failures) and correlate them with helpdesk tickets to detect process-level impersonation.

AD → vSphere Segregation. Decouple ESXi hypervisors from Active Directory wherever possible; if not feasible, enforce dedicated accounts, least-privilege roles, MFA on vCenter logins, and SSH disabled by default. Forward all logs from vCenter / VCSA / ESXi into the SIEM, then correlate “MFA reset → vCenter login → snapshot deletions → I/O spikes” to detect attack chains before full impact. Test offline restores regularly from immutable backups.

RMM & Lateral Movement Control. Formalize a strict remote tooling policy: define which solutions are approved, where they can be used, and what logs they must generate. Ban unattended access outside IT. Enhance EDR/NDR telemetry to flag RDP usage outside normal schedules, anomalous PsExec activity, and ad-hoc tunnels (e.g., Chisel, Plink). Deploy credential canaries and honeytokens to accelerate detection of credential theft and data exfiltration attempts.

For CTI Teams: Track TTPs, Not Labels

Useful CTI doesn’t stop at the name “Scattered Spider.” Maintain dynamic watchlists of DNS and HTTP patterns around okta, sso, help, internal, corp, and common obfuscations (he1p, servicedesk, vpn, work), enriched with fresh IoCs from ongoing campaigns. Monitor phishing kits, evolving infrastructures, and newly registered malicious domains. Correlate these findings with MFA enrollment events and the creation of new federated IdPs in your tenants.
In short: track the techniques, not the avatar.

A Process-Driven Adversary Requires Process-Driven Defense

Scattered Spider proves that process-driven adversaries will always outmaneuver purely technical defenses. Harden your EDR all you want; if your helpdesk validation process is weak, attackers will choose the human vector every time.

The answer is well-known but operationally demanding: phishing-resistant MFA, formalized guardrails on support processes, multi-layered log correlations (IdP, AD, hypervisors, backups), and tabletop exercises simulating realistic scenarios — from an impersonation call to ESXi-level ransomware deployment.

You won’t catch every trick. But by shrinking the blind spots that turn intrusions into catastrophes, you tilt the odds back in your favor.

Sources :

• Varonis – “Scattered Spider: What You Need to Know”
• CISA/IC3 – “Scattered Spider” (MITRE mapping, July 29, 2025, PDF)
• Check Point Research – “Exposing Scattered Spider: New Indicators…” (July 2025)
• Mandiant/Google Cloud – “Defending Your VMware vSphere Estate from UNC3944” (July 23, 2025)
• Reuters – “M&S Cyberattack Cost Estimate” (August 11/20, 2025)
• SecurityWeek – “WestJet Cyberattack” (June 16, 2025)
• The Record – “Hawaiian Airlines Cyberattack” (June 27, 2025)
• CrowdStrike – “SCATTERED SPIDER and BYOVD” (January 10, 2023)