Part 1: The Ecosystem and the Actors
By Jon DiMaggio, Cybersecurity Researcher
The most dangerous thing about The Com isn’t any single group inside of it, but that the ecosystem replaces them faster than law enforcement can arrest the ones already operating. In 2025 and 2026, law enforcement handed down real sentences to real people who did real damage, and the attacks kept coming anyway, under old and new names. That is a problem worth solving, and much of it is not technical; it’s human. Some of these actors use ransomware and technical exploitation, but the common thread across the ecosystem is social engineering: manipulating people and the support functions built to help them.
For years now, analysts and reporters have been understandably collapsing four distinct entities into a single headline. The actors themselves encourage it, because a bigger, scarier, unified enemy intimidates victims more than a small cluster or single threat actor does. But when you conflate them, you can make bad calls. You attribute a 2026 breach to a group that stopped operating in 2022. You defend against the wrong TTPs. You tell leadership that “Scattered Spider hit us” when the evidence supports nothing stronger than “someone in The Com hit us,” and later, you lose credibility.
This series is about doing it right. Defending against The Com entails separating them, weighting every attribution claim against the evidence that actually supports it, and treating clusters of activity, not brands or groups, as the unit of analysis. Before making any attribution call, ask the same question of every claim you publish: can I defend this in front of my peers? If so, say so and show the work, and if not, say that too. This paper applies it to the two that came first: Scattered Spider, the social-engineering machine that turned the help desk into a front door, and LAPSUS$, which proved you could extort a Fortune 500 company with a phone and a teenager’s confidence.
We start with the method, because the method is the point.
Key Takeaways About The Com
- The Com is an ecosystem, not a group, and it replaces actors faster than law enforcement can arrest them, which is why the 2025 and 2026 convictions did not stop the attacks.
- Three clusters, one brand: Scattered Spider, LAPSUS$, and ShinyHunters are distinct intrusion clusters, while SP1D3R HUNTERS (Scattered LAPSUS$ Hunters) is a shared brand stitched over them, not a fourth group.
- Attribution requires evidence proportional to the claim, and a court record or first-party incident-response report can carry attribution on its own. A single behavioral indicator (help-desk vishing, presence in a Com channel) cannot. When the evidence is weaker, multiple independent lines need to converge.
- LAPSUS$ is defunct and never deployed ransomware, so do not attribute activity after September 2022 to it.
- The arrests hit people, not the ecosystem: tradecraft and much of the personnel persisted under the SLH brand after the named individuals were removed.
Identity-First Threat Intelligence
See What The Com Is Saying About Your Organization Before They Call Your Help Desk
Social engineering starts with information. Flare gives security teams visibility into criminal posts and stolen credentials that expose or advertise details about their organizations, employees, and executives, so you can spot emerging threats and respond before that data is used for targeted attacks.
The Framework: Read the Ecosystem Before you Read the Group
What The Com Actually is
The Com (short for “The Community”) is not an organization, but a decentralized, predominantly English-speaking cybercriminal subculture, mostly young males, that lives on Discord, Telegram, and gaming platforms. It has no leader, no membership roll, and no single set of goals. What it has is a shared language, a shared set of techniques, and a status economy in which notoriety is a currency that trades right alongside payments and extortion money.
That last part matters more than people give it credit for. In most financially motivated crime, attention is a liability. In The Com, attention is often the product. Members brag, taunt, leak for applause, and pick targets partly for the reaction they will get. This is why financial motivation and pure notoriety coexist so comfortably here: for many of these actors, the payout and the clout are equal motivations. When you see an actor publicly claiming a breach that invites law enforcement, do not assume the move is purely irrational. Inside The Com, notoriety is its own currency, and for some of these actors it is worth more than the payout.
The Com bleeds into uglier territory. Some of its adjacent circles overlap with “harm groups” involved in stalking, sextortion, swatting, and coercing minors. This isn’t meant to sensationalize,but because it is part of the operating environment, and it explains some of the violence-adjacent pressure tactics you will see later in this series.
The Names at a Glance
Clusters to Brand mapping
Scattered Spider, LAPSUS$, and ShinyHunters are intrusion clusters. SP1D3R HUNTERS is a brand. That distinction is not a footnote, but the whole point.
- Scattered Spider is an intrusion cluster built on social engineering. It gets in, then sells or rents that access to whoever will pay.
- LAPSUS$ was a data-theft-and-extortion cluster, and is defunct. Both facts matter for attribution.
- ShinyHunters is a data-theft-and-extortion cluster built around cloud and SaaS. Covered in depth in Part 2 coming soon.
- SP1D3R HUNTERS, more fully “Scattered LAPSUS$ Hunters” (SLH), is a federated brand and coordination layer, not a discrete intrusion cluster. Also to be covered in Part 2.
The table below compares them side by side. Read it as three clusters and a brand, which is why the SLH column is set apart. If you take one thing from this paper, take that: three clusters and a brand are not four of the same thing.
Table 1: Master comparison matrix
A Word on Vendor Designations
Many organizations track these actors under their own naming schemes, and the names multiply every quarter. That complexity is not something to dismiss as noise. Understanding it is part of the discipline, because a vendor designation is a telemetry-defined activity cluster, not a group’s identity. When Mandiant keeps separate UNC numbers active even as the actors merge their branding, that separation is itself evidence. It is Mandiant’s way of signaling that the underlying activity clusters have not actually fused.
The table below maps the designations you need for this series. Learn the difference between a designation and a brand, and you have already won half the battle to prevent misattribution.
Table 2: Designation-to-brand mapping
Learn more about full profiling methodology behind these judgments, the confidence framework, the pivoting, the way a threat’s digital fingerprint gets built in The Art of Cyberwarfare and The Ransomware Diaries. Every claim in this series carries a confidence level. So should yours.
Scattered Spider: Social Engineering as a Weapon System
Why this Cluster is Different
Most intrusion sets live and die on malware or an exploit. However, Scattered Spider does something riskier and much harder to spot as malicious. It makes a phone call.
This is the most important takeaway about this cluster: it targets the human layer of enterprise security on purpose, treating help desks, identity systems, and account-recovery workflows as primary attack paths rather than support functions. The cluster is fluent in Western corporate procedure, down to the scripts an IT help desk uses to verify an employee, and it turns that fluency into access. It does not need a zero-day when it can get an MFA reset by sounding like a stressed employee who is late for a meeting.
The core TTPs are consistent across years of activity:
- Voice phishing (vishing): Operators build a credible employee persona from LinkedIn, breach data, and open-source scraps, then call the help desk with the right personal identifiers to trigger a password or MFA reset. In the MGM Resorts intrusion, the ALPHV affiliate claimed full tenant compromise followed from a single call to its support desk.
- SMS phishing (smishing): The August 2022 “0ktapus” campaign drove victims to adversary-controlled single-sign-on pages across more than 130 organizations, harvesting thousands of credentials and MFA codes from technology and SaaS providers.
- SIM swapping: Early operations leaned on SIM swaps against carriers and the business-process outsourcers that support them, which enabled account-recovery abuse and MFA interception.
- MFA fatigue: Later campaigns paired vishing with push flooding, wearing a target down until they approved a prompt or called a help desk the attacker was waiting to exploit.
- In these calls, the operator is calm, assertive, fluent, and rehearsed. The only tell may be a note of worry when the call starts getting away from them. They have the answers, too, because help desks everywhere ask the same handful of questions: date of birth, employee ID, manager’s name. In the cases they might not have an answer, they have a mundane excuse ready:New phone, wiped the old one before uninstalling Okta.
- New number, the old handset is being shipped back.
None of that is hard to find or rehearse. An FBI investigator familiar with these cases told me that operators sometimes use lower-value targets to rehearse these calls and refine their scripts.
Notice what is missing from that list: custom malware and novel exploits. Scattered Spider relies on legitimate remote-management software, AnyDesk, ScreenConnect, Splashtop, and the like, so its activity blends into normal administration. The one remote access trojan CISA names in its Scattered Spider advisory, RattyRAT, is used for persistent access and internal reconnaissance. The group’s advantage is not code, but people skills weaponized at scale.
The Signature Cases
MGM Resorts and Caesars Entertainment, September 2023
These two intrusions hit within weeks of each other and together defined the cluster in the public eye. Against MGM, operators identified an employee through professional networking data, impersonated that person to the help desk, obtained administrator credentials, manipulated the identity provider for persistence, and ultimately enabled deployment of ALPHV/BlackCat ransomware across more than a hundred ESXi hypervisors. MGM estimated a negative impact of approximately $100 million to Adjusted Property EBITDAR for the September 2023 period, plus under $10 million in one-time response costs, and refused to pay. A $45 million class-action settlement followed, though it resolved an earlier 2019 breach alongside this one, so do not read it as the price of this attack. Caesars, hit through a compromised third-party IT vendor, negotiated and paid a ransom reported at approximately $15 million.
Put those two outcomes side by side, and you get a clean lesson in the economics of this cluster. Same tradecraft, same window, two very different decisions by the victims, and both companies ended up spending enormous sums either way.
Scattered Spider operation timeline
0ktapus, August 2022
The credential-harvesting campaign that put Scattered Spider on the map at scale, hitting Twilio, Mailchimp, and dozens more, with downstream effects reaching their customers. Cloudflare was targeted but defended successfully using hardware security keys. It is the clearest early proof that this group could run the same access play across wildly different industries, because the common denominator was never the sector: it was the identity workflow.
The UK Retail Wave and the Ransomware Affiliate Arc
Over time, Scattered Spider rented its access out to whichever ransomware brand was ascendant: ALPHV/BlackCat in 2023, RansomHub through late 2024 and into 2025, and DragonForce in the 2025 wave against UK retailers including Marks & Spencer, Co-op, and Harrods. The affiliate label on the ransom note changed, but the initial access tradecraft underneath stayed the same.
The Weapon is a Procedure, not a Talent
None of this is secret. Google’s threat intelligence team tracks a separate cluster,as UNC6040,using the same help-desk playbook. The FBI and CISA have documented the technique independently.. The pattern is always the same: a caller impersonates IT or a SaaS provider’s support desk and walks the target, step by step, into authorizing a malicious connected app through a legitimate provider workflow. The attacker never needs the password or the MFA prompt, because the victim has granted standing access directly. It is the same connected-app abuse behind the Salesforce data theft wave.
What the public reporting makes clear, and what you should note , is how ordinary the tooling is. The help desk does not get beaten by elegant malware. It gets beaten by a procedure, run patiently against the human layer until someone clicks allow.
Weighing the Attribution
The attribution of this activity to Scattered Spider as a distinct cluster is rated at high confidence, and I want to be precise about why, because “high” is a claim you have to defend. That requires supporting evidence and analysis.
The basis is the combination of multiple independent lines of evidence: consistent and distinctive TTPs across years, infrastructure patterns that recur across campaigns, and a stack of unsealed court filings naming specific individuals as members. Independent analyses by Microsoft, Mandiant, Palo Alto Unit 42, and others corroborate continuity across these campaigns. Technical indicators, behavioral indicators, and the court record all point in the same direction.
The real discipline test is this:presence in a Com coordination channel is not, by itself, Scattered Spider attribution. Neither is the use of help-desk vishing, which by 2025 had spread across the ecosystem. If a single indicator is carrying your attribution, you do not have an attribution. You have an unsupported conclusion that requires further evidence.
The Arrests, and the Harder Question Underneath Them
Law enforcement spent 2025 and 2026 dismantling the people. The resulting list of arrests and convictions is substantial:
- Noah Michael Urban (“Sosa,” “King Bob,” “Elijah”): sentenced in August 2025 to 10 years in federal prison.
- Tyler Buchanan (“TylerB”): pleaded guilty in April 2026 to wire fraud conspiracy and aggravated identity theft tied to the 2022 0ktapus campaign, with sentencing scheduled for October 2026.
- Thalha Jubair and Owen Flowers: sentenced in July 2026 at Woolwich Crown Court to five and a half years each for the 2024 Transport for London attack, which the National Crime Agency called the UK’s biggest-ever cybercrime case. They had pleaded guilty in June 2026, on the first day of trial. Jubair remains wanted in the US, where a New Jersey complaint ties him to 120 intrusions across 47 entities, at least $115 million in ransom payments, and a breach of the federal court system. Investigators seized about $36 million in cryptocurrency from a linked server, with around $8.4 million reportedly moved out mid-seizure. The gap between the severity of the attack and the sentencing is something to note.
That is a serious body of impactful work by law enforcement. But the arrests raise a harder question: did taking down these individuals actually stop the threat? The answer requires looking beyond the arrests themselves, at what happened to the people, the tradecraft, and the broader ecosystem afterward. That is the question I’ll examine in Part 2 of this series, a separate article focused on what happened after the arrests and how the threat evolved.
My preliminary assessment, at moderate-to-high confidence, is no. The National Crime Agency framed the Jubair and Flowers sentencing as having effectively halted the group and noted, fairly, that others may continue using the damaged Scattered Spider brand. Microsoft separately assessed that the arrests materially degraded the group’s capability. Those are significant law enforcement outcomes. Through the first months of 2026, actors continued claiming activity under that name before those claims largely subsided. The evidence supports the following conclusion: the established Scattered Spider intrusion pattern, from help desk to identity provider to ransomware, largely went quiet following the arrests, while the tradecraft and much of the personnel persisted within the broader SLH brand. The arrests disrupted individuals, but not the tradecraft.
LAPSUS$: The Earlier Generation
Same Ecosystem, Different Era
LAPSUS$ is where much of this story begins, and it remains one of the most misunderstood groups in the modern cybercrime ecosystem. Analysts still attribute post-2022 activity to LAPSUS$, even though the group itself ceased operating years ago. So to be clear: LAPSUS$ is defunct, and it never deployed ransomware. Both of those facts are fundamental to accurate attribution, and I will hold the line on both.
LAPSUS$ operated at full capacity for roughly nine months, from its December 2021 attack against Brazil’s Ministry of Health through its concentrated campaign in early 2022, before a series of arrests in mid-to-late 2022 ended it as an organized entity. Its model was data theft followed by public extortion, not encryption. It stole source code and internal documents, threatened to publish them, and conducted much of the operation in public through a Telegram channel with tens of thousands of subscribers, even crowdsourcing target selection through polls. That visibility generated enormous attention and gave investigators the evidence they needed to dismantle the group.
The Operations
The target list was a tour of the technology industry: NVIDIA (roughly a terabyte of data, plus a demand that NVIDIA remove cryptomining limiters from its GPUs), Samsung (around 190GB including Galaxy source code), Microsoft (partial Bing and Cortana source), and Okta (to be discussed later). In September 2022, after the initial arrests, Arion Kurtaj, the group’s self-styled leader, breached Uber and Rockstar Games while on bail and under police protection, reportedly working from a hotel using a phone and a television’s streaming stick. The Rockstar intrusion leaked pre-release Grand Theft Auto VI footage and became one of the more infamous game-industry breaches on record.
The tradecraft is worth studying precisely because it was not sophisticated:
- Public insider recruitment: LAPSUS$ openly advertised on Telegram for employees willing to sell VPN or remote access. It treated insiders as an initial access market.
- Voice social engineering: It recruited callers, including minors, to run help-desk impersonation. Sound familiar? This is the technique Scattered Spider would industrialize.
- A SIM-swap pipeline: It targeted the business-process outsourcers servicing telecoms to enable number porting and MFA interception.
- No malware, no encryption: Legitimate tools like AnyDesk, cloud storage, and torrents for leaks. That was the whole toolkit.
The Okta Case, and a Lesson in Defensible Numbers
The Okta incident is a small masterclass in why you state figures carefully. In January 2022, LAPSUS$ compromised a support engineer’s account at Sitel, a third-party Okta contractor. When the group posted screenshots in March, Okta’s initial public estimate was that up to 366 customers, about 2.5% of its customer base, might have been affected. That figure spread quickly. Okta’s final forensic findings, however, were much narrower: the attacker controlled the workstation for only about 25 minutes and ultimately accessed only two customer environments.
The figure that survives scrutiny is that two customer environments were actually accessed, because that is the figure no informed reader can reasonably challenge. The 366 was a maximum potential estimate, not a measure of actual impact, and treating it as the latter is exactly the kind of overstatement that erodes confidence in an analyst’s work. State what you can defend. When you cannot defend a number with confidence, describe the event instead of forcing a figure.
What Happened to the Members
The people behind LAPSUS$ are, for the most part, accounted for. Kurtaj was found to have committed his offenses but ruled unfit to stand trial, and in December 2023 he received an indefinite hospital order. A UK minor was convicted alongside him. Brazilian authorities made arrests tied to the Ministry of Health attack. And then there is Thalha Jubair, who appears in the LAPSUS$ story as “ASyntax” and later, as we saw above, as a core Scattered Spider figure sentenced in 2026.
Jubair is the single best illustration of why you should be attributing to actors and clusters separately. He operated in LAPSUS$ during its window, then continued in Scattered Spider afterward. Those are sequential affiliations, not evidence that LAPSUS$ lived on. Collapse that distinction and you will “revive” a dead group every time one of its alumni resurfaces.
Attribution Guidance
Use this when activity is described as LAPSUS$ based primarily on shared social-engineering techniques, extortion without encryption, or association with the broader Scattered LAPSUS$ Hunters (SLH) brand:
- Attribute to LAPSUS$ only for activity in the December 2021 to September 2022 window, supported by contemporaneous claims, documented infrastructure, or links to court-documented members.
- Do not attribute activity to the original LAPSUS$ group after September 2022 solely because it involves help-desk vishing, insider recruitment, data-theft extortion, or use of the LAPSUS$ name within broader SLH branding. LAPSUS$ never deployed ransomware.
How They Relate without Being One
These clusters share an ecosystem, a rough demographic, and a growing overlap in technique. What they do not share is a single organization, a single roster, or a single chain of command. Scattered Spider and LAPSUS$ overlapped by a few months at the start and by at least one individual across their lifespans, and they still ran different playbooks against different targets toward different ends. ShinyHunters emerged earlier than both and built an entirely different, cloud-and-database-centric business. Then, in 2025 all three names got bolted together into a brand, “Scattered LAPSUS$ Hunters,” that is best understood not as a merger but as a shared public-facing brand that multiple actors live behind. Trustwave SpiderLabs assessed that fewer than five core operators, working across roughly thirty known handles, drive the bulk of the activity under the SLH brand.
The Com ecosystem and cluster relationships map
That brand, the misattribution it generates, and the fact that arresting the people behind it has not slowed the ecosystem are the subject of Part 2.
Recommendations for Security Teams
- Defend the human layer first. Treat the help desk, the identity provider, and account-recovery workflows as primary attack surface rather than support functions, and require strong identity verification before any password or MFA reset.
- Do not anchor attribution to the ransomware brand. The same access tradecraft rotates encryptors across ALPHV, RansomHub, and DragonForce. The name on the note tells you little about who got in.
- Weigh every attribution claim before you make it. Name a specific cluster only when TTPs, infrastructure, and the record converge. If one indicator is carrying the call, treat it as a lead, not a conclusion.
- Keep defunct groups “dead.” Do not attribute post-September 2022 activity to LAPSUS$, and do not revive a cluster because one of its alumni resurfaces elsewhere.
- Plan for the ecosystem, not the arrest. Assume tradecraft and personnel persist under new brands like SLH, and monitor for rebrands, help-desk social engineering, and typosquatted SSO and help-desk domains.
The Future of The Com, and Where You Fit In
The Com will keep producing groups for as long as the underlying incentives hold, and the incentives are not going anywhere: low barriers to entry, a status economy that rewards audacity, an endless supply of enterprises that trust a voice on the phone, and identity systems that were built for convenience rather than adversarial pressure. You are not going to arrest your way out of that, and 2026 is the proof, because the arrests happened and the attacks continued.
But security teams can adapt too. Harden the help desk and the identity provider, because that is the door every one of them exploits. And when you attribute an intrusion, hold yourself to the standard this series argues for: name the specific cluster only when the evidence supports it, weigh the claim, and separate what you know from what you suspect. Stop making “take my word for it” attributions. Demand evidence, and make sure your attribution can survive someone who wants to prove you wrong. The adversary is counting on you to conflate. Don’t.
Identity-First Threat Intelligence
See What The Com Is Saying About Your Organization Before They Call Your Help Desk
Social engineering starts with information. Flare gives security teams visibility into criminal posts and stolen credentials that expose or advertise details about their organizations, employees, and executives, so you can spot emerging threats and respond before that data is used for help-desk vishing, MFA resets, extortion, or other targeted attacks.
