Scattered Spider Expands Arsenal with Qilin and RansomHub Ransomware in Sophisticated Cloud Attacks

Executive Summary

On July 17, 2026, threat intelligence researchers at Microsoft and several partner firms confirmed a significant tactical shift in the operations of the group tracked as Scattered Spider (also known as Octo Tempest or UNC3944). Historically known for their aggressive social engineering and SIM-swapping capabilities, the group has now officially integrated the Qilin and RansomHub ransomware variants into their post-exploitation toolkit. This move follows the recent infrastructure disruptions of their former partners, highlighting the group's resilience and adaptability within the cybercriminal ecosystem. The current campaign targets global enterprises, specifically focusing on compromising administrative credentials for cloud-based identity and access management (IAM) platforms.

Threat Analysis

Scattered Spider remains one of the most volatile and dangerous financially motivated threat actors in the current landscape. Their primary entry vector continues to be sophisticated social engineering, typically involving phone-based phishing (vishing) or SMS-based phishing (smishing) directed at IT help desk personnel. By impersonating employees or authorized contractors, the actors persuade support staff to reset passwords or enroll new multi-factor authentication (MFA) devices under the attackers' control. Once initial access is established, the group moves with alarming speed, often bypassing traditional perimeter defenses by leveraging legitimate administrative tools and compromised privileged accounts to maintain persistence within the environment.

Technical Details

In recent incidents observed over the last 48 hours, the group has utilized the Qilin (also known as Agenda) ransomware-as-a-service (RaaS) platform for final payload delivery. Qilin is written in Rust, which allows for cross-platform targeting and provides high performance for large-scale file encryption. In conjunction with Qilin, the actors have also been seen deploying RansomHub, a relatively new variant that specializes in targeting VMware ESXi environments and Windows-based servers.

Post-compromise activity often involves the use of legitimate remote monitoring and management (RMM) software, such as AnyDesk or ScreenConnect, to establish a covert C2 channel. The actors frequently employ 'living-off-the-land' (LotL) techniques, utilizing PowerShell and Windows Management Instrumentation (WMI) to enumerate network resources and identify high-value data repositories. Before initiating the encryption phase, Scattered Spider exfiltrates sensitive data using tools like Rclone, directing stolen assets to public cloud storage providers (e.g., Mega.nz) to facilitate secondary extortion demands.

Attribution Assessment

Intelligence analysts maintain a high level of confidence in attributing this activity to Scattered Spider. The group’s tradecraft is distinct, characterized by their fluent English-speaking operators, deep knowledge of corporate help desk workflows, and a specific focus on gaming, technology, and telecommunications sectors. While the group consists of a decentralized network of individuals often associated with the 'Com' hacking community, their operational security and technical sophistication align with the profiles previously documented by Microsoft MSTIC and Mandiant. The adoption of new ransomware strains like RansomHub suggests a pragmatic shift to diversify their revenue streams and mitigate the risk of law enforcement action against any single RaaS provider.

Implications

The integration of multiple ransomware families signifies an escalation in the group's ability to tailor attacks to specific organizational infrastructures. Organizations relying heavily on cloud-based SSO and IAM solutions are at heightened risk, as the attackers prioritize the subversion of identity providers to gain broad, unmonitored access. The speed at which Scattered Spider transitions from initial entry to full-scale encryption—often within 24 to 72 hours—leaves little room for traditional incident response delays. The potential for data exposure combined with operational downtime creates a double-extortion scenario that can devastate an organization's reputation and financial stability.

Recommendations

Encrygma recommends that organizations immediately implement the following defensive measures:

1. Phishing-Resistant MFA: Transition away from SMS and telephony-based MFA in favor of FIDO2-compliant hardware keys or certificate-based authentication.
2. Help Desk Hardening: Implement rigorous identity verification protocols for all password reset and MFA enrollment requests, including 'out-of-band' verification via known-good contact methods.
3. IAM Monitoring: Establish real-time alerts for unauthorized modifications to global administrative roles or the addition of new federation providers within Entra ID (Azure AD) and Okta.
4. Endpoint Security: Deploy and configure EDR solutions to detect the presence of unauthorized RMM tools and unusual Rclone activity.
5. Segmented Backups: Maintain immutable, offline backups of critical data, ensuring that storage accounts are protected by strict conditional access policies.