Scattered Spider: Detection Engineering Dilemma - Detecteam

Scattered Spider is a hot topic. As a native English speaking group, it quickly grew as a threat to various organizations. Being a versatile threat actor, from data leak to ransomware deployment. It is described by various references, such as (but not limited to): https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320ahttps://reliaquest.com/blog/scattered-spider-attack-analysis-account-compromisehttps://www.attackiq.com/2025/05/29/emulating-scattered-spiderhttps://unit42.paloaltonetworks.com/muddled-libra-evolution-to-cloudhttps://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applicationshttps://www.tidalcyber.com/blog/scattered-spider-evolving-resilient-group-proves-need-for-constant-defender-vigilance Known Scattered Spider aliases are: 0ktapus, oktapus, UNC3944, Starfraud, muddled...