Scattered Spider is behind some of the most expensive breaches of the last two years. Almost none of them started with malware. They started with a phone call, and no firewall has ever stopped a phone call.
Picture the call.
It's 4:40 on a Friday afternoon. Your helpdesk agent has been on shift for seven hours. The next caller sounds harried, a little embarrassed.
"Hi — I'm so sorry, this is Priya from the finance team, I report to Michael Chen. I'm at the airport and I've just realised my phone's gone. I can't get the authenticator code and I've got the quarter-end file due tonight. Is there any way you can reset it? My employee ID is—"
She knows the org chart. She knows the jargon. She knows about quarter-end. She is patient and apologetic and does not push too hard, which is exactly why the agent believes her.
She is not Priya.
Four minutes later, the MFA is reset, and a criminal group is inside a company that has spent millions on cybersecurity. In April 2025, that pattern took Marks & Spencer's website offline for weeks. The company's half-year statutory pre-tax profit came in at £3.4 million, down from nearly £392 million a year earlier, a fall of 99%, with roughly £324 million in lost sales. The Co-op, hit in the same wave, put its own losses near £80 million.
No zero-day. No exotic malware. Just a phone call.
The group is Scattered Spider, also tracked as UNC3944, Octo Tempest, and 0ktapus. Financially motivated, active since 2022, and made up largely of native English-speaking operators.
That last detail matters more than it sounds. Their core skill isn't code. It's a conversation. They research a target employee on LinkedIn and public data until they can hold the call. Then they phone the helpdesk as that person and talk the agent into resetting the password or the MFA. Sometimes they skip the helpdesk and hijack the employee's phone number itself, a SIM swap, where the mobile carrier is persuaded to move the number to the attacker's SIM, so the security codes arrive on their phone instead of hers.
Through 2025, help-desk voice phishing appeared in nearly every observed Scattered Spider intrusion.
Now look at what's actually being exploited. Not a flaw in your software. A flaw in a process designed to be helpful. Most helpdesks run the same reset procedure for every account, no matter whose it is, so the attacker can aim straight at a senior administrator's login and skip most of the work a break-in usually requires. The helpfulness is the vulnerability.
You can patch a server. You cannot patch a tired human being's instinct to solve someone's problem.
Once that call succeeds, something quietly inverts.
The attacker is no longer an intruder trying to get in. They are a legitimate, authenticated user, often a privileged one. And nearly every tool you own runs on one assumption: an authenticated user is a trusted user.
Antivirus sees nothing, because no malware ran. The firewall sees nothing, because it's a valid login with valid credentials. Your identity provider sees nothing, because from where it sits, Priya just logged in.
Then they compound it. Rather than deploying custom hacking tools, Scattered Spider operates using the same remote-control software your own IT team uses every day — AnyDesk, TeamViewer, ScreenConnect. Security teams call this living off the land: using the legitimate tools already sitting in your environment, so the activity dissolves into normal admin work. Think of a burglar who doesn't bring a crowbar because he's already been handed the keys, and who does his moving in a van with your company's logo on the side.
Which is how a group that cost a retailer £324 million did it while looking, to most of your controls, like an employee doing her job.
And they are quick. Where a nation-state actor may sit patiently for a year, Scattered Spider is typically exfiltrating data within hours, then detonating ransomware. So "keep the bad guys out" is the wrong mental model entirely. They don't stay out. They log in.
The real question is harder: would you notice one of your own trusted accounts behaving like a stranger, and could you act before hours turn into headlines?
If you can't catch them by looking for bad software, you catch them by watching how the account behaves.
Because here's the tell. The attacker holds valid credentials. But they are not Priya. And the real Priya has never, in three years, reset her own MFA from an unfamiliar country at 3 a.m., enrolled a brand-new authenticator device eleven minutes after a password change, and then created a rule that quietly forwards her inbox to an outside Gmail address.
Every one of those actions is invisible to a tool asking "is this login valid?."
But each one of those actions is glaring for a security tool that is asking "is this how this person actually behaves?"
That shift, from inspecting files to inspecting behaviour, across identity, endpoint, and network at once is what it takes to catch this group.
Here is how Invinsense does it, step by step, as the attack unfolds.
Much of this attack can be starved before it starts.
ASM (Attack Surface Management) looks at your organisation from the outside, the way the attacker does. It hunts for the fake login pages they build to phish your staff, the group registers domains stuffed with words like okta, sso, vpn, helpdesk, and scans the dark web for your employees' and vendors' leaked passwords. Those leaked details are what let a caller sound credible. Reset them first and the script falls apart before it's read.
GSOS hardens the layer the whole attack depends on, your people. Awareness training, phishing simulations, vishing simulations, and rehearsal calls, so the agent who eventually picks up the real one has heard it before. It also rates third-party and vendor risk, because Scattered Spider routinely breaks into a supplier or IT provider first and rides the trusted connection in through the side door.
Assentra gives you one honest inventory of every device and account, and points at the ones that are unmanaged or have no security agent installed. Those are the machines nobody is watching. They are precisely what the attacker goes looking for.
This is the heart of the attack, and where Invinsense SIEM earns its place. The SIEM is the central nervous system: it pulls logs from your identity provider (Okta, Microsoft Entra), your cloud apps, your network, and your business systems into one place, so a quiet signal in one corner can be seen next to a quiet signal in another. Four detection use-cases sit here specifically for this group:
The moment any of these crosses the line, SOAR, the automation layer that executes the response, acts without waiting for an analyst to be awake: disable the account, kill its active sessions.
Against a group that moves in minutes, an alert that waits until Monday morning isn't a defence.
It's a record of what happened.
Now they sign in as her, usually from somewhere new.
UEBA (User and Entity Behaviour Analytics, a learned baseline of what normal looks like for each person) catches what static rules can't: impossible-travel logins (Mumbai at 09:14, Ohio at 09:41, nobody flies that fast), unfamiliar devices, and a privileged account signing in far outside its usual hours. Scattered Spider works off-hours on purpose, because fewer people are watching. UEBA is the thing that's still watching.
Scattered Spider knows you'll eventually reset the compromised password. So they build back doors that don't depend on a password at all. Invinsense SIEM watches for the exact shapes those take:
Now they need to operate inside. UEC, the agent on your Windows, Linux, and Mac machines, takes over here, doing three jobs:
The payday is extortion, lately with DragonForce ransomware. And just before the encryption, they tell on themselves:
Underneath every step, one rule holds. On any confirmed high-risk detection, SOAR runs a playbook in seconds: disable the account, end its sessions, isolate the device. At 3 a.m. on a Sunday, exactly as reliably as at 3 p.m. on a Tuesday.
Against an adversary that moves in minutes, a response measured in minutes is the entire game.
Read the steps together and the logic is plain. Scattered Spider's strength is that each individual action looks legitimate, a reset, a login, a new device, a running copy of AnyDesk.
Invinsense doesn't try to catch them in one perfect moment. It watches identity, endpoint, and network at once, so the sequence, reset, then foreign login, then new authenticator, then forwarding rule, assembles into one recognisable picture while there is still time to pull the plug.
Here's the honest part.
Everything above detects the consequences of a successful call, often fast enough to contain it. But the call itself doesn't land on a firewall. It lands on a person. And a tired agent at 4:40 on a Friday, talking to someone who knows the org chart, the jargon, and the quarter-end deadline, is not a problem a SIEM rule solves.
Which is why the human layer isn't a footnote to this defence. It is part of the defence. An agent who has already sat through a realistic vishing simulation is materially harder to fool than one who has read a policy PDF. A verification step that doesn't bend for a convincing story closes a door the technology can only watch. Phishing-resistant MFA that cannot be reset over the phone removes the attack's favourite move entirely.
Any vendor who tells you a product alone stops Scattered Spider has not understood how Scattered Spider works.
The most expensive breaches of 2025 didn't begin with a broken lock. They began with a helpful "yes."
They don't defeat your authentication, they persuade someone to switch it off. They don't smuggle in exotic malware, they borrow the tools you already trust. They don't climb your walls, they walk through the front door wearing an employee's face.
So the question was never "are our walls high enough?"
It's "when a trusted account starts behaving like a stranger, would we see it, and would we act, before the call becomes a headline?"
Discover complete cybersecurity expertise you can trust and prove you made the right choice!
