New Research Explores Emulating Scattered Spider Tactics in Real-World Scenarios

Experts describe methods for mimicking the tactics of the advanced persistent threat group Scattered Spider in a recent in-depth analysis by threat emulation specialists Lares, aiming to help enterprises test and strengthen their defenses. Lares designs controlled simulations that mirror real-world TTPs to assess network, endpoint, and cloud security, identify incident response gaps, and improve overall posture, blending ethical hacking, red teaming and threat modelling.

Scattered Spider, a financially motivated APT emerging in May 2022, has targeted telecommunications, business process outsourcing, hospitality, retail, healthcare and aviation, and is linked to high-profile breaches such as the 2023 MGM Resorts and Caesars Entertainment incidents.

The group uses social engineering, SIM swapping, phishing and weak verification exploitation to gain initial access, with further capabilities including cloud credential theft, BYOVD-style attacks and misconfigurations in Active Directory.

According to the report, its workflows cover initial access through exfiltration, including credential dumping, SSO and cloud‑based lateral movement, and exfiltration via tools such as Telegram, Rclone and storage explorers, underscoring why proactive threat emulation can boost organisational resilience.