Skip to content
844-974-8669 Ask Zeus Book a call

Intelligence briefFall/Winter 2026/2027 Edition

Scattered Spider convictions land as the help desk playbook moves to new crews

Courts in the UK and US have sentenced Scattered Spider members and the NCA says the crew is effectively halted, but ShinyHunters-branded crews now run the same help desk vishing playbook. Harden resets and MFA now.

Download the PDF, 819 KB Talk to the SOC

At a glance

SE-01 · Social engineering crew

  • $115M+ Ransoms the DOJ alleges victims paid, May 2022 to September 2025[4]
  • 5.5 yrs Sentence each for Jubair and Flowers, July 16, 2026[1]
  • 12% ShinyHunters share of Coveware's Q2 2026 extortion cases, second among actors[24]
  • $70M+ Extorted by ShinyHunters in 2026 so far, per the FBI[22]
Status
Disrupted. The NCA says its action against Jubair and Flowers effectively halted the group's criminal activity and cites Microsoft's assessment that the arrests materially degraded it, while other criminals keep using the brand and its techniques.[1]
Initial access
Help desk impersonation, phishing and smishing, push bombing, SIM swaps[13]
Targets
Large companies and their contracted IT help desks[13]
Ransomware partners
DragonForce most recently; ALPHV/BlackCat as an affiliate from mid-2023[13]
Alleged ransoms
More than $115 million paid, per the DOJ complaint against Jubair[4]
Prosecutions
UK sentences July 2026; US pleas and sentences 2025 to 2026[1]
Successor crews
Scattered LAPSUS$ Hunters, then ShinyHunters-branded vishing and SaaS extortion[20]

What happened

The original edition dissected the 2023 casino intrusions, the 2024 Snowflake credential campaign and the April 2025 Marks & Spencer attack, all built on a phone call. Since then courts in the UK and US have taken guilty pleas or imposed sentences on several named members, and the FBI and CISA refreshed their advisory with 2025 tradecraft. The help desk and vishing playbook has moved to ShinyHunters-branded crews that Google tracks separately.

  • Thalha Jubair and Owen Flowers pleaded guilty on June 22, 2026, the first day of trial, to a Computer Misuse Act section 3ZA offense over the August to September 2024 Transport for London attack and were each sentenced to five and a half years at Woolwich Crown Court on July 16, 2026. The NCA and CPS put TfL's losses and recovery costs at 29 million pounds, and Flowers also admitted conspiring against two US health systems, SSM Health and Sutter Health.
  • A US complaint unsealed September 18, 2025 charges Jubair with computer fraud, wire fraud and money laundering conspiracies and alleges about 120 intrusions, at least 47 US victims and more than $115 million in ransoms paid between May 2022 and September 2025. The DOJ says a complaint is only an allegation and that he is presumed innocent.
  • Tyler Buchanan pleaded guilty in April 2026 to conspiracy to commit wire fraud and aggravated identity theft over an SMS phishing scheme that took at least $8 million in cryptocurrency. Noah Urban was sentenced to 10 years with $13 million restitution in August 2025. The DOJ announced on July 1, 2026 that Peter Stokes, 19, was extradited from Finland and charged by complaint in Chicago over a May 2025 intrusion at a luxury jewelry retailer; he is presumed innocent.
  • Connor Moucka pleaded guilty in Seattle federal court in August 2026 to computer fraud, wire fraud, aggravated identity theft and conspiracy over the 2024 Snowflake customer breaches. The DOJ cites more than 165 organizations and at least $9.5 million in victim company losses; sentencing is set for October 27, 2026 and co-defendant John Binns remained outside US custody as of the court's August 4 update.
  • The joint FBI, CISA and partner advisory updated July 29, 2025 adds DragonForce ransomware on VMware ESXi, thousands of rapid Snowflake queries for exfiltration, new identities backed by fake social media profiles and rotating proxies. It also documents the actors searching Slack, Teams and Exchange Online for mentions of the intrusion and joining incident response calls.
  • Scattered Lapsus$ Hunters, an alliance of Scattered Spider, LAPSUS$ and ShinyHunters personas, lost its domains to police in October 2025. In 2026 ShinyHunters-branded crews ran help desk vishing against single sign-on, scraped Salesforce Experience Cloud sites and breached an FBI recruiting site, followed by arrests in the Netherlands and the US and a reported detention in Jordan.

How it works

The attack as a living map, in kill-chain order from the first foothold to impact. Point at a step to light its wiring, click to pin its story.

at risk
  • entry
  • next step
  • impact

Read the attack chain

The threat on the left, each step in order, the people at risk on the right: point at a step to light its wiring, click to pin its story here.
00the attack chain
  • entry
  • next step
  • impact

Tap a node to read its story.

Step by step

  1. Build the pretext

    MITRE ATT&CK T1589 (opens in a new tab)

    Actors gather employee names, titles, managers and partial personal data, then pose as company IT or help desk staff, or as an employee calling the help desk.

  2. Talk past MFA

    MITRE ATT&CK T1621 (opens in a new tab)

    Phone and SMS phishing, push bombing and SIM swaps win a password reset, a new MFA device or a one-time code without exploiting software. In January 2026 callers told employees the company was updating MFA settings, sent them to look-alike single sign-on pages and registered the attacker's own device.

  3. Install remote access

    MITRE ATT&CK T1219 (opens in a new tab)

    Employees are directed to run commercial remote access tools. The actors then create new identities in the environment and back them with fake social media profiles.

  4. Find the keys and listen

    MITRE ATT&CK T1213.002 (opens in a new tab)

    They search SharePoint for credential documents and watch Slack, Teams and Exchange Online for mentions of the intrusion, even joining remediation calls.

  5. Pull data fast

    MITRE ATT&CK T1567 (opens in a new tab)

    Where Snowflake access exists they run thousands of queries at once to move large volumes in a short time; in 2026 campaigns the same speed was used against SharePoint, Salesforce and other SaaS.

  6. Extort, then encrypt

    MITRE ATT&CK T1486 (opens in a new tab)

    Data theft for extortion comes first. In recent cases DragonForce ransomware encrypted VMware ESXi servers as a second lever.

Who is at risk

Any organization whose help desk can reset a password or MFA method on a phone call is exposed, and the crews that inherited the playbook now go after SaaS tenants as much as corporate networks.

  • Large companies and their contracted IT help desks and outsourcers, the targets the FBI and CISA name; the M&S chairman said the point of entry also involved a third party.
  • Retail, hospitality, gaming, technology, managed service providers and financial services, the sector history Microsoft documented, plus UK retailers M&S, Co-op and Harrods named in the NCA's July 2025 arrests.
  • Healthcare systems: Flowers admitted conspiring against SSM Health and Sutter Health, and Krebs reports Mandiant and Google saw Oracle PeopleSoft data theft across higher education, healthcare and government.
  • Salesforce customers with public Experience Cloud sites whose guest user profiles carry overly broad permissions, and Okta, Microsoft 365, Google Workspace and Snowflake tenants where one phished sign-on or one account without MFA opens the data.

Sectors in scope

  • Retail
  • Hospitality and gaming
  • Telecommunications and business process outsourcing
  • Technology and managed service providers
  • Financial services
  • Airlines and public transport
  • Healthcare systems
  • SaaS and CRM tenants (Salesforce, Snowflake, Okta, Microsoft 365)
04What changed

What changed since the last edition

Fall/Winter 2026/2027 Edition8 changes

  1. UK convictions: Jubair and Flowers pleaded guilty on June 22, 2026 and were sentenced to five and a half years each on July 16, 2026 over the 29 million pound Transport for London attack of August to September 2024, which the CPS believes are the first prosecutions under section 3ZA of the Computer Misuse Act.

    Source 3

  2. US prosecutions advanced: Stokes was extradited from Finland and charged in Chicago (announced July 1, 2026), Buchanan pleaded guilty in April 2026, Moucka pleaded guilty in August 2026, and Urban drew 10 years in August 2025. A DOJ official now puts the group at over 100 network intrusions and more than $100 million in ransom payments.

    Source 5

  3. The FBI and CISA advisory was updated July 29, 2025 with tradecraft from investigations through June 2025: DragonForce ransomware on ESXi, rapid Snowflake exfiltration, new identities backed by fake social media profiles, proxy networks and rotating machine names.

    Source 13

  4. The brand merged into Scattered LAPSUS$ Hunters. The alliance threatened Salesforce data it said came from 39 companies, lost its dark web and clearnet domains to police in October 2025, leaked data from six companies on October 10, 2025, and promised an extortion-as-a-service return in 2026.

    Source 17

  5. The vishing playbook scaled up in January 2026. Google tracks three clusters (UNC6661, UNC6671 and UNC6240) in which callers posed as IT staff, sent employees to victim-branded single sign-on pages, captured credentials and MFA codes, registered their own device, then took data from Microsoft 365, Salesforce, DocuSign and Google Workspace.

    Source 20

  6. Salesforce warned in March 2026 that a known threat actor was scraping public Experience Cloud sites through guest profiles with overly broad permissions, using a modified Mandiant scanner. ShinyHunters told The Register it took data from about 100 companies, a claim Salesforce did not confirm.

    Source 19

  7. ShinyHunters arrests in autumn 2026: Dutch police arrested a 24-year-old man on September 15, Reuters reported a suspect known as Rey was detained and is cooperating, and the FBI arrested a Canadian ransomware negotiation executive in Pennsylvania on October 8 on a complaint alleging extortion conspiracy. The FBI says the group extorted more than $70 million so far in 2026.

    Source 22

  8. Marks & Spencer's cost is better known: the 300 million pound figure was a projection of lost operating profit, and M&S booked 101.6 million pounds in attack costs in the half year, expects about 34 million more and received 100 million pounds in insurance proceeds.

    Source 15

What to do now

In priority order, highest impact first.

  1. Do firstRequire positive identity verification before any password or MFA reset on a privileged or executive account, whether the caller claims to be the employee or IT: callback to a number on file, manager approval, and video or in-person checks for admins.

    Every signature intrusion in this report began with a help desk or an employee being talked into a reset.

  2. Move privileged and remote access to phishing-resistant MFA (FIDO2 keys or passkeys) and remove SMS and push approval for admins.

    The advisory says phishing-resistant MFA resists push bombing and SIM swaps, and Google makes the same point about the 2026 vishing.

  3. Alert on any new MFA device registration, MFA method change or super admin grant shortly after a reset, and on new identities in Okta, Entra and Google Workspace.

    The actors register their own device after a vishing call and create backstopped identities to persist.

  4. Block unauthorized remote access tools with application allowlisting and alert on first use of tunneling tools such as ngrok.

    Employees are coached into installing commercial remote access software that gives the actor a foothold without malware.

  5. Audit SaaS tenants now: Salesforce connected apps and Experience Cloud guest permissions, Snowflake MFA, and stale contractor credentials.

    The 2024 Snowflake and 2026 Salesforce campaigns used valid credentials and misconfigurations, not platform flaws.

  6. Run incident response on an out-of-band channel and assume compromised Slack, Teams and email are being read.

    The advisory documents the actors joining remediation calls to learn how they are being hunted.

  7. Keep offline, tested backups of identity infrastructure and ESXi workloads.

    DragonForce encryption of ESXi is the second lever once extortion over stolen data stalls.

  8. Rehearse the vishing call with your help desk and your outsourced IT provider, then review Microsoft 365 posture and 24/7 monitoring coverage; Z7's SOC and Microsoft 365 posture review fit here.

    The attack surface is a person on a phone, and the vendor's help desk counts as yours.

Indicators

Indicators the sources publish, shown as they print them. Use them to hunt and to enrich alerts, and check the source before you block.

Indicators published by the sources
TypeIndicatorSource
behavior Employee reports a call or text from 'IT' saying MFA settings are being updated, or asking them to install a remote access tool or approve an MFA prompt [20]
domain Look-alike single sign-on domains following the pattern <companyname>sso.com or <companyname>internal.com [20]
behavior Thousands of Snowflake queries from one account in a short window, or large exports from SharePoint credential folders [13]
behavior New user identities created shortly after a help desk reset, with matching new social media profiles [13]

Sources

Every number and claim in this brief traces to a source below. Each source opens in a new tab at the publisher.

  1. [1]
    Two Scattered Spider Hackers Sentenced to Jail in UK (opens in a new tab) SecurityWeek · July 16, 2026 · securityweek.com
  2. [2]
  3. [3]
  4. [4]
  5. [5]
  6. [6]
    Scattered Spider hacker pleads guilty to stealing $8 million in cryptocurrency (opens in a new tab) Help Net Security (reporting the DOJ release) · April 21, 2026 · helpnetsecurity.com
  7. [7]
    Scattered Spider Hackers Plead Guilty on Day 1 of Trial (opens in a new tab) Krebs on Security · June 23, 2026 · krebsonsecurity.com
  8. [8]
  9. [9]
    Snowflake hacker pleads guilty, faces up to 32 years in prison (opens in a new tab) Help Net Security (reporting the DOJ release) · August 6, 2026 · helpnetsecurity.com
  10. [10]
    Snowflake Hacker Pleads Guilty Over Breach of 165+ Organizations (opens in a new tab) The Hacker News · August 6, 2026 · thehackernews.com
  11. [11]
    Canadian Man Arrested in Snowflake Data Extortions (opens in a new tab) Krebs on Security · November 5, 2024 · krebsonsecurity.com
  12. [12]
    UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion (opens in a new tab) Google Cloud / Mandiant · June 10, 2024 · cloud.google.com
  13. [13]
    Joint Cybersecurity Advisory AA23-320A: Scattered Spider (updated) (opens in a new tab) FBI, CISA, RCMP, ASD's ACSC, AFP, CCCS, NCSC-UK · November 16, 2023, updated July 29, 2025 · cisa.gov
  14. [14]
  15. [15]
    Marks & Spencer gets $130 million in insurance from cyberattack (opens in a new tab) Reuters via Business Insurance · November 5, 2025 · businessinsurance.com
  16. [16]
    M&S confirms social engineering led to massive ransomware attack (opens in a new tab) BleepingComputer (reporting M&S chairman's evidence to Parliament) · July 8, 2025 · bleepingcomputer.com
  17. [17]
  18. [18]
  19. [19]
    ShinyHunters claims yet another Salesforce customers breach (opens in a new tab) The Register (reporting Salesforce's advisory) · March 9, 2026 · theregister.com
  20. [20]
    Vishing for Access: Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft (opens in a new tab) Google Cloud / Google Threat Intelligence Group · January 30, 2026 · cloud.google.com
  21. [21]
    ShinyHunters Extorted Boeing Spin-off Prior to Arrests (opens in a new tab) Krebs on Security · October 7, 2026 · krebsonsecurity.com
  22. [22]
    FBI Arrests Founder of Ransomware Negotiation Firm (opens in a new tab) Krebs on Security · October 9, 2026 · krebsonsecurity.com
  23. [23]
    FBI arrests another suspected ShinyHunters hacker after agency breach (opens in a new tab) BleepingComputer · October 9, 2026 · bleepingcomputer.com
  24. [24]
  25. [25]
    UK police arrest four in connection with M&S, Co-op and Harrods cyberattacks (opens in a new tab) Reuters via CP24 (reporting the NCA) · July 10, 2025 · cp24.com
  26. [26]
    Threat group profile: DragonForce (opens in a new tab) Halcyon · updated July 27, 2026 · halcyon.ai
  27. [27]
  28. [28]
    Europol-led crackdown on The Com hackers leads to 30 arrests (opens in a new tab) BleepingComputer (reporting Europol) · February 27, 2026 · bleepingcomputer.com

Z7 Weekly Intelligence

We aim for one email a week: the threats that matter, new Z7 intelligence briefs and articles, and what to do about them. Unsubscribe anytime.

By subscribing, you agree to our Terms of Use. Our Privacy Policy explains how we use your email.

All Z7 Cyber Intelligence briefs
  • RW-05Ransomware group dormant

    ALPHV BlackCat dormant, Change breach 192.7M

    TakeawayRequire MFA on remote access and vet your vendors.

    • 192.7M people in the Change Healthcare breach, final estimate
    • $395.3M ALPHV/BlackCat ransom payments reported to FinCEN
    • ALPHV BlackCat
    • Ransomware group
    • Healthcare and health insurance
    PDF801 KB
  • RW-06Ransomware ecosystem active

    RaaS fragments as Qilin and The Gentlemen lead

    TakeawayHarden edge devices, identity and hypervisors now.

    • 93 active leak-site groups in Q2 2026
    • 2,139 leak-site victims in Q2 2026
    • Ransomware-as-a-service ecosystem
    • Ransomware ecosystem
    • Critical manufacturing
    PDF777 KB
  • RW-04Ransomware group active

    Akira still exploits SonicWall VPNs in 2026

    TakeawayPatch, reset VPN credentials, require MFA and watch failed logins.

    • $244.17M ransomware proceeds Akira had claimed as of late September 2025
    • 750 Akira leak-site claims in 2025 (ransomware.live)
    • Akira
    • Ransomware group
    • Manufacturing
    PDF827 KB

What does this mean for your security?

Bring your questions about exposure, defenses and cost. Talk with our team about what applies to your environment and where to start.

Book a security conversationAsk Zeus Call 844-974-8669
Ask Zeus AI assistant