Scattered Spider is the name given to a loosely organized, largely English-speaking cybercriminal collective that became infamous for breaching major companies not through exploits, but through phone calls. Their signature: call the IT helpdesk, impersonate a real employee with researched personal details, and talk the agent into resetting credentials or MFA. Once inside, deploy ransomware or extortion. The group has been the subject of law-enforcement advisories, and its central technique — helpdesk vishing — has been copied across the criminal ecosystem, which is why the playbook matters more than the group.
The playbook, step by step
- Research: employee names, roles, managers, and personal details assembled from LinkedIn, breach data, and public records.
- The call: to IT support, posing as the employee — locked out, under deadline pressure, sometimes with number spoofing (see spoofed numbers) and increasingly with cloned voices.
- The reset: the agent, verifying identity with researchable knowledge questions, resets the password or enrolls a new MFA device.
- Escalation: from one identity to privileged access, then data theft and ransomware.
The breach's technical phase begins after the human phase already succeeded.
Why it keeps working
Helpdesks are measured on resolution speed; knowledge-based verification checks what an attacker can Google; and no one audits reset verification the way finance audits payments. It is the sub-threshold wire problem (see dual authorization) transplanted to IT: the high-risk action with the low-friction path.
The controls that actually stop it
- Identity verification on every reset using something research can't produce — an enrolled device, a callback to a registered number, or verified ID.
- A no-exception rule under urgency, because urgency is the technique.
- Per-ticket verification logging so reset compliance is a number (see account takeover prevention).
- Simulation testing of the helpdesk itself (see vishing simulation tools).