Skip to main content

Netskope coverage of Scattered Spider's tactics

Source Decision Insights Coverage Published May 29, 2025 Companies 4
Human View Machine View

4 companies named across 10 categories, one of 6 articles referencing Netskope. Previous coverage: CISA advisories and KEV updates, plus CloudBees Unify and Azure Managed Redis - Week of May 26, 2025 (May 2025).

Companies mentioned

Best suited for

Persona
Security Operations Leader
Decision stage
How to start
Adoption curve
Early Majority

Our classification, not the publisher's statement. Best suited for, not only for.

The group known as Scattered Spider, also referred to as UNC3944 and other aliases, has emerged as a financially motivated entity targeting various sectors through social engineering and ransomware attacks.

Tactics of Scattered Spider

This group employs a range of social engineering tactics that include:

  • Phishing and smishing campaigns, often impersonating identity management services such as Okta.
  • Vishing attacks, where members impersonate employees to manipulate IT staff for password resets.
  • Exploiting Multifactor Authentication (MFA) fatigue by overwhelming targets with multiple authentication requests.
  • Utilizing Subscriber Identity Module (SIM) swapping to capture victim phone numbers and access your MFA (MFA).

Once they compromise a system, Scattered Spider leverages tools like AnyDesk and TeamViewer to maintain access, alter passwords, and navigate within networks. Their operations have expanded to include cloud environments and applications such as AWS, Azure, SharePoint, and Slack, employing various ransomware families like BlackCat and DragonForce.

Security Recommendations

  • Organizations should train all personnel, particularly helpdesk employees, to recognize and counteract social engineering tactics effectively.
  • With Netskope solutions in place, entities are advised to utilize Advanced Threat Protection and Remote Browser Isolation to shield against phishing and malware threats.

Additionally, implementing Netskope's advanced detection capabilities can help identify command and control communications that exploit legitimate traffic patterns.

This summary reflects the important developments regarding Scattered Spider and offers actionable strategies for organizations looking to enhance their cybersecurity posture against these threats.

Blog post, originally published by Ray Canzanese at netskope.com.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/netskope-coverage-of-scattered-spiders-tactics/",
        "name": "Netskope coverage of Scattered Spider's tactics",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/netskope-coverage-of-scattered-spiders-tactics/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/netskope/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/netskope/",
      "name": "Netskope"
    },
    "articleSection": [
      "Cybersecurity",
      "AI infrastructure",
      "Network Operator"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-coverage/#person",
      "@type": "Person",
      "name": "Decision Insights Coverage",
      "url": "https://decisioninsights.ai/author/decision-insights-coverage/"
    },
    "dateModified": "2026-08-24T10:56:49-06:00",
    "datePublished": "2025-05-29T18:39:18-06:00",
    "description": "Scattered Spider, a financially motivated adversary group, employs social engineering tactics and ransomware targeting varied sectors.",
    "headline": "Netskope coverage of Scattered Spider's tactics",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Ray Canzanese"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/netskope/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/netskope/",
        "name": "Netskope"
      },
      "url": "https://www.netskope.com/blog/netskope-threat-coverage-scattered-spider"
    },
    "keywords": [
      "Authentication",
      "Multifactor Authentication",
      "Phishing",
      "Ransomware",
      "Social Engineering",
      "Subscriber Identity Module",
      "Threats"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/netskope-coverage-of-scattered-spiders-tactics/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-24",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/amazon.com/amazon-web-services-aws/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/amazon.com/amazon-web-services-aws/",
        "name": "Amazon Web Services (AWS)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/microsoft/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/microsoft/",
        "name": "Microsoft"
      },
      {
        "@id": "https://decisioninsights.ai/registry/netskope/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/netskope/",
        "name": "Netskope"
      },
      {
        "@id": "https://decisioninsights.ai/registry/okta/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/okta/",
        "name": "Okta"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-coverage/#person",
    "@type": "Person",
    "description": "Blog posts, podcasts, and video analysis from across the industry, condensed into short, sourced summaries. Produced under our Standards & Methodology.",
    "name": "Decision Insights Coverage",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-coverage/"
  }
]

Is this your company? Get structured data for your own pages