[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fu9NyY756wEhjobdsnhewOjm0CwG-D-SAsDzqEWjtSKw":3},{"article":4,"iocs":51,"watch_terms":63,"solutions":64,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"6244349d-90a9-4f90-b1ac-b2227e563b8c","Alleged Scattered Spider hacker extradited to the United States","alleged-scattered-spider-hacker-extradited-to-the-united-states-bde064","A dual United States and Estonian citizen has been extradited to the U.S. to face charges alleging he was a member of the Scattered Spider hacking collective. [...]","Peter Stokes, a dual U.S. and Estonian citizen, has been extradited to the U.S. to face charges for his alleged involvement in the Scattered Spider hacking collective. Stokes, who used multiple online aliases, is accused of participating in at least four major breaches, including one targeting a luxury retailer, which resulted in demands for millions in ransom and significant operational disruptions for victims. Scattered Spider, known for its use of social engineering and MFA bombing, has targeted numerous high-profile companies globally.","Alleged Scattered Spider hacker extradited to the U.S. to face charges for multiple breaches.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Falleged-scattered-spider-hacker-extradited-to-the-united-states\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F04\u002F20\u002FHacker-spider-large.jpg","2026-07-02T08:58:25+00:00","2026-07-02T10:00:18.21219+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"Scattered Spider","threat_actor",{"name":21,"type":19},"0ktapus",{"name":23,"type":19},"Octo Tempest",{"name":25,"type":19},"Scatter Swine",{"name":27,"type":19},"UNC3944",{"name":29,"type":19},"Muddled Libra","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",[52,56,60],{"type":53,"value":54,"context":55},"malware","DragonForce","Encryptor used in ransomware attacks by Scattered Spider",{"type":57,"value":58,"context":59},"mitre_attack","T1137","MFA bombing (MFA fatigue) used by Scattered Spider",{"type":57,"value":61,"context":62},"T1078","Credential access via social engineering and phishing used by Scattered Spider",[],{"controls":65,"vendors":144},[66,95,121],{"slug":67,"name":68,"problem":69,"products":70},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":96,"name":97,"problem":98,"products":99},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[100,108,113],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":109,"product_name":110,"url":111,"description":112},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":122,"name":123,"problem":124,"products":125},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[126,133,138],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":127,"product_name":130,"url":131,"description":132},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":134,"product_name":135,"url":136,"description":137},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":139,"product_name":140,"url":142,"description":143},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":165},"scattered-spider-hacker-extradited-social-engineering-mfa-bombing-lessons","Scattered Spider Hacker Extradited: Social Engineering & MFA Bombing Lessons","Scattered Spider's success stems primarily from exploiting the human element — using social engineering and MFA fatigue (bombing) attacks to bypass technical controls that organizations have invested heavily in. This case highlights that even robust perimeter defenses can be rendered ineffective when employees can be manipulated into granting access or approving fraudulent authentication requests. The resulting breaches led to ransomware demands worth millions and significant operational disruption, demonstrating the cascading financial and reputational consequences of a single compromised identity. Organizations must recognize that technical controls alone are insufficient without a security-aware workforce trained to recognize and resist manipulation tactics.",[150,151,152,153,154,155,156,157,158,159,160,161,162,163,164],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 5: Account Management","CIS Control 6: Access Control Management","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST SP 800-63B: Digital Identity Guidelines (Phishing-Resistant MFA)","NIST SP 800-61r2: Computer Security Incident Handling Guide","NIST CSF ID.AM \u002F PR.AC \u002F DE.AE","NIST AC-2: Account Management","NIST AC-17: Remote Access","NIST SI-4: Information System Monitoring","MITRE ATT&CK T1621: MFA Request Generation (MFA Bombing)","MITRE ATT&CK T1566: Phishing \u002F Social Engineering","GDPR Article 32: Security of Processing (for EU-affected victims)","ITIL 4: Incident Management Practice",{}]