[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSmwAXXUdOue6gDhCPMrZzRLhc2cA90vtTpgi8U-SzbA":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":130},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"0f4a5590-bf3c-43df-bd0f-427575e07c2d","Early Scattered Spider member pleads guilty to cybercrime spree","early-scattered-spider-member-pleads-guilty-to-cybercrime-spree-9c5f3b","Ahmed Elbadawy pocketed massive proceeds from his crimes. Prosecutors are seeking the forfeiture of about $17.6 million in virtual currency, luxury vehicles, and a vast collection of jewelry and designer bags. The post Early Scattered Spider member pleads guilty to cybercrime spree appeared first on CyberScoop.","Ahmed Elbadawy, a member of the Scattered Spider cybercrime group, has pleaded guilty to federal charges including wire fraud conspiracy and aggravated identity theft. The group targeted high-net-worth individuals by stealing credentials through social engineering and then extorting them for virtual currency. Prosecutors are seeking the forfeiture of approximately $17.6 million in assets, including virtual currency, luxury vehicles, and jewelry.","Scattered Spider member Ahmed Elbadawy pleads guilty to cybercrime spree.","https:\u002F\u002Fcyberscoop.com\u002Fscattered-spider-member-guilty-ahmed-elbadawy\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2025\u002F09\u002FGettyImages-1234689200.jpg","2026-09-18T20:24:15+00:00","2026-09-18T22:00:12.429238+00:00",8,[17,20],{"name":18,"type":19},"Scattered Spider","threat_actor",{"name":21,"type":19},"The Com","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":22,"icon":24,"name":25,"slug":26},null,"Threat Intelligence","threat-intelligence",[28,33,38],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":34},{"id":35,"icon":24,"name":36,"slug":37},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":39},{"id":40,"icon":24,"name":41,"slug":42},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[],{"controls":46,"vendors":129},[47,76,102],{"slug":48,"name":49,"problem":50,"products":51},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":77,"name":78,"problem":79,"products":80},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":98,"product_name":99,"url":100,"description":101},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":103,"name":104,"problem":105,"products":106},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[107,115,122],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":103,"product_name":119,"url":120,"description":121},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":123,"product_name":126,"url":127,"description":128},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[],{"slug":131,"title":132,"body":133,"framework_refs":134,"framework_notes":144},"scattered-spider-member-pleads-guilty-social-engineering-leads-to-176m-in-fraud","Scattered Spider Member Pleads Guilty: Social Engineering Leads to $17.6M in Fraud","Scattered Spider exploited human trust rather than technical vulnerabilities, using social engineering to steal credentials from high-net-worth individuals and then leveraging those credentials to commit wire fraud and extortion. This case illustrates that even technically sophisticated targets can be compromised when social manipulation bypasses technical controls. The scale of financial damage — $17.6 million in forfeited assets — underscores how rapidly credential theft can escalate into catastrophic losses. Organizations and individuals alike must recognize that attackers will always seek the path of least resistance, and that path is often a convincing phone call or phishing message rather than a firewall exploit.",[135,136,137,138,139,140,141,142,143],"CIS Control 14 – Security Awareness and Skills Training","CIS Control 6 – Access Control Management","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant MFA)","NIST CSF PR.AC-1 – Identities and credentials are managed","NIST CSF DE.CM-3 – Personnel activity is monitored","NIST SP 800-50 – Building an IT Security Awareness and Training Program","GDPR Article 32 – Security of Processing (appropriate technical and organizational measures)","ITIL Service Management – Incident and Problem Management","PCI DSS Requirement 12.6 – Security Awareness Program",{}]