Scattered Spider is a financially motivated cybercrime group associated with data theft, extortion and ransomware deployment. CrowdStrike traces its activity to early 2022. The name describes tracked criminal activity rather than a single ransomware family; attribution to a particular incident requires separate evidence.
The 2025 joint government advisory describes attacks on large companies and their contracted IT help desks, including commercial facilities and other sectors. The advisory documents evolving activity through June 2025.
Reported methods include impersonating employees or support staff, obtaining password or multifactor authentication resets, repeated authentication prompts and SIM swapping. The group uses legitimate remote access tools and steals data for extortion. The advisory also describes ransomware use, including DragonForce, without making encryption a necessary feature of every intrusion.
Government and industry reporting characterize the activity as criminal and financially motivated. The advisory associates the names UNC3944, Scatter Swine, Oktapus, Octo Tempest, Storm-0875 and Muddled Libra with the group. Those tracking labels do not by themselves prove common operators or responsibility for a specific victim.
The Insurer reports Scattered Spider responsibility and notes that Tokio Marine has not named the actor. Attribution confidence is low; no company confirmation or incident-specific technical proof was found. This is a reporting-based association, not a verified actor self-claim, proof of ransomware or a basis to infer the initial access method.
