Expert Intel
Unravelling the Web: An Overview of Scattered Spider
Published: May 9, 2025
Updated: September 03, 2026
Expert: Charlie Kelly
Role: SOC Analyst
Specialises in: Security Operations
What you will learn:
In this edition of Expert Intel, you’ll uncover who Scattered Spider are, why they’re gaining notoriety, and how they may be linked to recent cyber-attacks on retailers like M&S and The Co-op. We’ll explore their evolving methods and motivations and share practical steps your organisation can take to stay ahead of this growing threat.
“Scattered Spider aren’t emerging - they’re evolving. Their mix of social engineering and technical skill shows just how agile and dangerous even loosely organised threat groups can be.”
Who Are Scattered Spider?
Scattered Spider – also known as Octo Tempest or Roasted 0ktapus – are a financially motivated cybercrime group active since at least 2022.
They gained notoriety through a string of high-impact breaches in the US, including the MGM Resorts and Caesars Entertainment attacks in 2023.
Despite being loosely affiliated and often young, their operational maturity is notable, regularly combining social engineering with deep knowledge of enterprise systems.
Why are they back in the headlines?
In 2025, major UK retailers, including Marks and Spencer, Co-op, and Harrods, reported significant cyber incidents. While formal attribution is ongoing, many security analysts have pointed to Scattered Spider due to similarities in technique, tooling, and targeting.
Their known focus on retail, gaming, and hospitality – combined with a track record of high-profile extortion – places them among the top suspects.
Motivations and Target Sectors
Scattered Spider are financially driven. They operate with clear ROI in mind, often using extortion, data theft, and ransomware as end goals. Their known targets span:
This wide attack surface reflects a focus on sectors with complex IT environments and high sensitivity to disruption.
Common Techniques
Scattered Spider typically employs a blend of social engineering and technical abuse to gain initial access and escalate privileges. Their tactics include:
These techniques are often used in combination, increasing their effectiveness and making early detection more difficult.
Why Their Attacks Work
The group’s success stems from a hybrid approach: exploiting both people and systems. They often:
Their agility allows them to bypass many standard security controls, especially where user trust and session persistence are not well managed.
Defending Against Scattered Spider
Scattered Spider are experts in Social Engineering and laterally moving in environments. To counter their tactics, organisations should:
The Main Takeaway
Scattered Spider are not an emerging threat – they’re an active, evolving one. From casinos to cloud providers to the UK high street, their campaigns show how modern cybercrime groups adapt quickly, scale globally, and exploit the weakest points in the human-technology interface.
Defending against them requires more than awareness – it demands coordination across IT, security, and leadership teams to build a truly resilient security posture.
If you’re concerned about organised threats and want to stay one step ahead of social engineering attacks, our security experts at Stripe OLT are here to help.
Book a free discovery session with us — we’re here to asses your current security posture and recommend tailored strategies to protect your organisation from evolving threats.
find us on Youtube
