Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
8 IOCs
Scattered Spider: Social Engineering Meets Cloud Ransomware Tactics
Threat Actors
Malware Families
Excerpt
Scattered Spider has emerged as one of the most sophisticated and dangerous cybercriminal groups in recent years. This English-speaking threat actor has gained notoriety for its exceptional social engineering skills and high-profile attacks, including the 2023 MGM Resorts breach that caused widespread system shutdowns and the recent 2025 attacks on major UK retailers. What makes Scattered Spider particularly concerning is its rapid evolution from SIM swapping and credential…
Read the original report →Diamond Model
Adversary(3)
Infrastructure(6)
Capability(6)
Victim
Indicators of Compromise
Open the mindmap →8 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | twitter-okta.com | High | Score 58/100 | First seen |
| CVE | CVE-2015-2291 | Medium | Score 54/100 | First seen |
| Domain | gucci-cdn.com | High | Score 58/100 | First seen |
| IP | 99.25.84.9 | High | Score 58/100 | First seen |
| Domain | victimname-cdn.com | High | Score 58/100 | First seen |
| Domain | victimname-sso.com | High | Score 58/100 | First seen |
| Domain | victimname-servicedesk.com | High | Score 58/100 | First seen |
| CVE | CVE-2021-35464 | Medium | Score 51/100 | First seen |
IOC Relationship Graph
Building graph…