[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcawAjBqyuKLd3pLdJoXFjwC3FaVSkNoLW2HCnCBLgr0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":48,"controls":55},"9d1c7ac4-ae65-4465-85ff-4833f3e701b8","scattered-spider-member-pleads-guilty-social-engineering-leads-to-176m-in-fraud","0f4a5590-bf3c-43df-bd0f-427575e07c2d","Scattered Spider Member Pleads Guilty: Social Engineering Leads to $17.6M in Fraud","Scattered Spider exploited human trust rather than technical vulnerabilities, using social engineering to steal credentials from high-net-worth individuals and then leveraging those credentials to commit wire fraud and extortion. This case illustrates that even technically sophisticated targets can be compromised when social manipulation bypasses technical controls. The scale of financial damage — $17.6 million in forfeited assets — underscores how rapidly credential theft can escalate into catastrophic losses. Organizations and individuals alike must recognize that attackers will always seek the path of least resistance, and that path is often a convincing phone call or phishing message rather than a firewall exploit.","**Immediate actions:**\n- Enroll all high-value accounts in phishing-resistant MFA (e.g., FIDO2\u002Fhardware security keys) rather than SMS-based authentication.\n- Brief employees and high-net-worth clients on current social engineering tactics, including vishing and SIM-swapping schemes used by groups like Scattered Spider.\n\n**Long-term improvements:**\n- Implement a formal Security Awareness Training program with simulated phishing and social engineering exercises conducted at least quarterly.\n- Establish strict out-of-band identity verification procedures before any credential resets or account changes are processed.\n- Adopt a Zero Trust architecture that continuously validates user identity and device posture, limiting the blast radius of stolen credentials.\n\n**Detection measures:**\n- Deploy behavioral analytics (UEBA) to flag anomalous account activity such as logins from new geographies or unusual transaction volumes.\n- Monitor dark web and threat intelligence feeds for mentions of organizational credentials or executive identities being traded or auctioned.",[12,13,14,15,16,17,18,19,20],"CIS Control 14 – Security Awareness and Skills Training","CIS Control 6 – Access Control Management","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant MFA)","NIST CSF PR.AC-1 – Identities and credentials are managed","NIST CSF DE.CM-3 – Personnel activity is monitored","NIST SP 800-50 – Building an IT Security Awareness and Training Program","GDPR Article 32 – Security of Processing (appropriate technical and organizational measures)","ITIL Service Management – Incident and Problem Management","PCI DSS Requirement 12.6 – Security Awareness Program",{},"published","2026-09-18T22:20:23.124828+00:00","2026-09-18T22:20:22.702+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fcyberscoop.com\u002Fscattered-spider-member-guilty-ahmed-elbadawy\u002F","early-scattered-spider-member-pleads-guilty-to-cybercrime-spree-9c5f3b","Early Scattered Spider member pleads guilty to cybercrime spree",[30,36,42],{"id":31,"name":32,"slug":33,"description":34,"color":35},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":37,"name":38,"slug":39,"description":40,"color":41},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":43,"name":44,"slug":45,"description":46,"color":47},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[49],{"id":50,"date":51,"edition":52,"title":53,"audio_url":54},"720d8f46-1f79-4b3b-8389-af7d6c8e8bef","2026-09-19","morning","ThreatNoir Weekend Brief — September 19","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-19\u002Fthreatnoir-morning-brief-2026-09-19.mp3",[56,60,64],{"slug":57,"name":58,"problem":59},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":61,"name":62,"problem":63},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":65,"name":66,"problem":67},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]