Scattered Spider
Also known as UNC3944, Octo Tempest, 0ktapus
Young, English-speaking intruders who talk their way past help desks, then hand the network to a ransomware brand. Linked to the MGM, Caesars and Marks & Spencer attacks.
- What it is
- Financially motivated collective
- Based
- English-speaking, largely UK and US
- Active
- 2022–
- Status
- Active; members prosecuted
On the record
Jul 2026 · Help Net Security
Thalha Jubair and Owen Flowers are each jailed for five and a half years over the £29 million attack on Transport for LondonMay 2025 · BleepingComputer
M&S forecasts a £300 million profit hit from the April attack and suspends online orders into JulyOct 2023 · BleepingComputer
MGM puts the cost of the September attack at about $100 million
In the ledger
$15 million paid in the one payment listed
- Sep 2023Caesars Entertainment paid $15 million. Reported.
2 outages listed
- Apr 2025Marks & Spencer: £300 million. M&S's own forecast of the hit to operating profit, before insurance.
- Sep 2023MGM Resorts: $100 million. MGM's SEC filing estimate of the hit to third-quarter results.
