Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In a November 16, 2023 report, CyberScoop said the FBI was asking companies targeted by Scattered Spider to share information because investigators did not yet know the full breadth of the group’s activity. The request mattered because incidents at different organizations could reveal connected tactics, infrastructure, or people—and help investigators understand a loosely connected cybercrime ecosystem.
Why did the FBI want more information from victims?
Senior FBI officials told CyberScoop that victims were spread across the country and that the investigation was centrally managed. They did not disclose investigative details, but said the bureau needed more information from victims to understand the group’s reach. Information from one organization can help authorities connect activity seen elsewhere, although the report did not specify which evidence the FBI sought in individual cases.
CyberScoop reported that the FBI had known the identities of “at least a dozen members tied to the hacking group” for more than six months. The briefing did not say whether those people had been arrested. An unnamed senior FBI official cautioned: “Just because you don’t see actions being taken, it doesn’t mean there aren’t actions being taken.”
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteFor a victim organization, sharing incident details with the FBI and other relevant authorities can contribute to a broader picture of campaigns that might otherwise look like separate attacks. It can also give investigators evidence to compare across victims. The 2023 report did not describe the status of the investigation after that briefing.
#1 Best Overall
Who or what is Scattered Spider?
Scattered Spider is a name used for financially motivated cyber activity associated with breaches including those at MGM Resorts and Caesars Entertainment in September 2023. The label should not be treated as proof of a single, tightly organized group with a fixed membership list. The activity is associated with “the Com”—short for “community”—a loose ecosystem of disparate, sometimes competing factions. Some participants engage in cybercrime and, in some cases, physical violence for hire.
Analysts have used several overlapping names for activity connected with this cluster. CyberScoop identifies Scattered Spider, UNC3944, Scatter Swine, and Muddled Libra. Microsoft’s October 25, 2023 analysis tracks overlapping activity as Octo Tempest and says it overlaps with 0ktapus, Scattered Spider, and UNC3944. These are research and tracking labels; they do not establish that every person or incident associated with one name belongs to the same organization or chain of command.
Microsoft Security’s Incident Response and Threat Intelligence teams described Octo Tempest as “a financially motivated collective of native English-speaking threat actors” whose campaigns prominently feature adversary-in-the-middle techniques, social engineering, and SIM swapping. Microsoft also characterized the actor as “one of the most dangerous financial criminal groups” in its 2023 publication. Those descriptions apply to Microsoft’s tracking of Octo Tempest, not automatically to every participant in the broader Com ecosystem.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How can a help-desk attack become a major breach?
The recurring weakness in the reported activity is identity: persuading people or systems to grant access, then using that access to reach more valuable accounts and data. Microsoft’s account describes several possible entry routes rather than one fixed sequence.
1. Get an initial foothold through identity support or stolen access
Attackers may call help-desk or technical staff while impersonating an employee, seek a password reset or MFA-factor change, send SMS phishing messages, or use purchased credentials or session tokens. A SIM swap or call forwarding can redirect a victim’s phone number, undermining protections that rely on SMS or phone calls. Microsoft also describes adversary-in-the-middle (AiTM) techniques, which can capture credentials or session material during a deceptive sign-in process.
2. Map the organization and expand privileges
After gaining access, the actor may enumerate users, groups, devices, cloud resources, repositories, storage, and security settings. Microsoft documents privilege escalation through further help-desk manipulation, abuse of manager-account approvals, collection of plaintext secrets, and changes to identity or access policies. An initial compromised account can therefore become a route to administrative access if approval and identity controls are weak.
3. Make access persist and weaken detection
Microsoft describes enrolling actor-controlled devices, replaying tokens that carry satisfied MFA claims, and changing identity or federation settings. Other reported persistence methods include forged SAML tokens, remote-management tools, and reverse shells. The actor may also disable or impair security products or add exclusions, making suspicious activity harder to detect.
Free tools Windows power users keep installed
One-click scans. No signup required.
4. Steal data, extort the victim, or encrypt systems
Data theft can involve repositories, SharePoint, databases, cloud storage, and email. The sequence can then move to exfiltration and extortion, with encryption in some incidents. Microsoft reported that Octo Tempest became an ALPHV/BlackCat affiliate in mid-2023 and began deploying Windows and Linux ransomware, with particular focus on VMware ESXi servers. This describes Microsoft’s reporting on Octo Tempest; it is not evidence that every Scattered Spider-linked intrusion used ransomware.
Best Value
What do the MGM and Caesars figures show?
The reported financial impact figures are not directly interchangeable: they come from different reporting and may cover different costs.
| Organization | Reported figure | Attribution and scope |
|---|---|---|
| Caesars Entertainment | Roughly $15 million reportedly paid | The Wall Street Journal figure, relayed by CyberScoop in 2023. |
| MGM Resorts | More than $100 million | MGM’s federal filings, as relayed by CyberScoop in 2023, said the attack would cost more than this amount. |
| MGM Resorts | More than $110 million in direct and indirect costs | A CyberScoop follow-up cited CNN reporting this figure in 2023. It has a different attribution and scope from the filing figure. |
The two MGM estimates should be kept separate rather than combined or presented as one definitive total. Both were reported in 2023, and the cited accounts describe costs with different scope.
Which controls address the attack chain?
Microsoft’s published Octo Tempest guidance supports a layered approach: make identity changes harder to manipulate, limit what a compromised account can do, and detect unauthorized changes quickly. No single control covers every stage.
Recommended Free Tools
| Attack stage and identity surface | Defensive control | What it helps address |
|---|---|---|
| Initial access: privileged sign-ins and help-desk-supported accounts | Require phishing-resistant MFA, such as a FIDO2 security key, for privileged roles. | Reduces reliance on phishable credentials and phone-based MFA factors. It does not prevent an attacker from persuading staff to approve an account change. |
| Initial access: help desk and technical support | Require strong identity verification for password resets and MFA changes; keep support permissions limited to the work each role requires. | Makes employee impersonation and unauthorized factor changes harder to complete. |
| Privilege escalation: identity provider and administrator roles | Reduce permanent privileged assignments; use time-bound, eligible roles and review elevation events. | Limits the time an account has high privileges and makes unexpected elevation more visible. |
| Persistence: identity provider, devices, and cloud control plane | Monitor for new devices, administrator-group changes, trusted-location changes, federation-setting changes, and security-product exclusions. | Surfaces changes that can preserve access or weaken security after an account is compromised. |
| Persistence and lateral movement: remote administration | Review remote-administration tools and cloud-management activity for unexpected additions or changes. | Helps identify unauthorized management paths established after initial access. |
| Exfiltration, extortion, or encryption: incident response | When affected, share relevant incident evidence with the FBI and other relevant authorities. | Contributes victim information to the broader investigation and can help connect related activity. |
Prioritize phishing-resistant MFA for privileged accounts, then ensure that help-desk identity checks and privilege elevation cannot be bypassed by a convincing impersonation alone. Monitoring matters because identity, device, federation, and security-policy changes can signal that an attacker is trying to turn temporary access into durable control.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
