Scattered Spider

Owen Flowers and Thalha Jubair, alleged members of the Scattered Spider threat actor group, were sentenced to five and a half years each for their roles in a 2024 cyberattack on Transport for London (TfL) that disrupted 148 systems and affected 27,000 employees. The attack, which exfiltrated personal and financial data and nearly led to a network shutdown, caused £29 million in losses and recovery costs. The hackers also targeted US healthcare organizations, with threats to disrupt critical systems, and are linked to a broader campaign of social engineering, SIM swapping, and data extortion spanning hundreds of attacks from 2022 to 2025.

Two key members of the Scattered Spider cybercrime group, Thalha Jubair and Owen Flowers, were sentenced to five years and six months in prison for their involvement in the August 2024 breach of Transport for London (TfL). The attack disrupted critical internal systems, forced 27,000 employees to reset passwords, and led to the theft of customer data. The group is also linked to over 120 network intrusions globally, including attacks on U.S. healthcare providers and critical infrastructure, resulting in over $115 million in extortions.

A threat actor tracked as O-UNC-066 is conducting vishing attacks to trick Microsoft 365 users into enrolling attacker-controlled passkeys through a phishing kit that mimics the legitimate Microsoft Entra passkey enrollment process. The attackers register domains with 'passkey' in the name and use voice calls to socially engineer victims into following a fake enrollment flow, ultimately granting unauthorized access to their accounts. The phishing kit is operator-controlled and adapts in real time to the victim's MFA method, allowing the attacker to capture credentials and approve passkey registration. This campaign targets multiple industries and abuses Microsoft's passkey adoption initiative as a social engineering lure.

This week's threat landscape highlights a range of cyber activities, from cloud bucket hijacking and ransomware tooling overlaps to social engineering campaigns and supply chain attacks. Notable incidents include a global fraud operation resulting in nearly 6,000 arrests, typosquatting of payment SDKs on npm and PyPI, and the abuse of Microsoft Teams for delivering EtherRAT. Additionally, new techniques like Process Parameter Poisoning and ADFS token forgery underscore evolving evasion and privilege escalation methods.

U.S. prosecutors have linked 19-year-old Peter Stokes, allegedly part of the Scattered Spider hacking group, to a May 2025 breach of a luxury jewelry retailer. The attackers used social engineering to manipulate the IT help desk into resetting passwords and bypassing multifactor authentication, then deployed tunneling tools like ngrok and Teleport to exfiltrate over 77 GB of data. Despite ransomware deployment being blocked, the attackers demanded $8 million in cryptocurrency. The FBI traced Stokes via a persistent Windows device ID tied to Microsoft account activity and correlated IP addresses from his online accounts.

The article covers multiple cyber threats including the disruption of the NetNut residential proxy network, which leveraged compromised home devices to route malicious traffic. Threat actors are targeting researchers with fake proof-of-concept repositories delivering the ChocoPoC RAT, while the Scattered Spider group is linked to extortion attempts. New malware such as Ousaban and browser-based ransomware exploit social engineering and legitimate browser APIs, and AI-driven attacks are increasing in sophistication, including indirect prompt injection and fake phishing pages generated via AI.

The article highlights the increasing speed of cyberattacks, with adversaries achieving data exfiltration in as little as 72 minutes. Attackers leverage compromised credentials and identity-based techniques to rapidly escalate privileges and move laterally across environments. Modern SOCs struggle to keep pace due to manual processes and fragmented workflows. Threat actors like Muddled Libra and Spoiled Scorpius are exemplifying this trend by exploiting identity weaknesses to accelerate attack timelines.