Scattered Spider Returns: New Wave of Social Engineering Attacks on Financial Services
Executive Summary
In late 2025, cybersecurity researchers at ReliaQuest linked a new wave of attacks in the financial services sector to the notorious cybercrime collective Scattered Spider, despite previous claims that the group had disbanded. These attacks featured advanced social engineering tactics, the registration of lookalike domains, and exploitation of internal access paths to facilitate credential compromise and lateral movement inside targeted organizations. Impact resulted in unauthorized access to sensitive financial data, disruption of key operations, and raised concerns about the sector’s preparedness for sophisticated, identity-driven threats.
The re-emergence of Scattered Spider underscores a resurgence of high-profile, financially motivated cybercrime against critical industries. The campaign highlights the evolving threat landscape—where even 'retired' threat groups rapidly adapt their tactics—reinforcing the urgency of east-west security monitoring, identity protections, and robust zero trust strategies.
Why This Matters Now
Financial institutions face renewed urgency to assess and strengthen defenses due to Scattered Spider’s proven ability to bypass conventional perimeter controls using social engineering and lookalike domains. This incident demonstrates that dormant threat actors can resurface with updated techniques, increasing the risk to sensitive data and compliance posture across the sector.
Attack Path Analysis
Scattered Spider initiated access through credential phishing or exploitation of exposed cloud assets targeting financial services. They escalated privileges via compromised credentials or abuse of IAM roles, enabling broader control. Leveraging east-west movement, they navigated internal resources and workloads to identify critical assets. The attackers established command and control over the compromised environment, likely using covert channels and remote access tools. Sensitive financial and customer data was exfiltrated via unauthorized outbound traffic, evading basic controls. Ultimately, they aimed to disrupt operations and potentially deploy ransomware, causing significant business impact.
Kill Chain Progression
Initial Compromise
Description
Attackers gained access through phishing or exploiting publicly exposed interfaces in cloud environments targeting financial institutions.
Related CVEs
CVE-2015-2291
CVSS 7.8A vulnerability in the Intel Ethernet diagnostics driver for Windows allows local users to execute arbitrary code with kernel privileges via crafted IOCTL calls.
Affected Products:
Intel Ethernet diagnostics driver for Windows – < 1.3.1.0
Exploit Status:
exploited in the wildCVE-2021-35464
CVSS 9.8A Java deserialization vulnerability in ForgeRock AM server allows unauthenticated remote code execution via crafted requests.
Affected Products:
ForgeRock AM server – < 7.0
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Phishing
Exploit Public-Facing Application
Valid Accounts
Gather Victim Identity Information
Stage Capabilities
Compromise Infrastructure
Brute Force
Modify Authentication Process
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Strong Authentication for Access to Cardholder Data Environment
Control ID: 8.3.1
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA (Digital Operational Resilience Act) – ICT Risk Management Framework
Control ID: Article 8
CISA Zero Trust Maturity Model 2.0 – Identity and Access Management
Control ID: Identity Pillar
NIS2 Directive – Cybersecurity Risk Management Measures and Reporting
Control ID: Article 21
GLBA (Gramm-Leach-Bliley Act) – Safeguards Rule
Control ID: 501(b)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
Primary target of Scattered Spider's renewed attacks with increased lookalike domains threatening zero trust segmentation and egress security controls.
Banking/Mortgage
High-risk sector facing sophisticated cybercrime group attacks requiring enhanced threat detection, encrypted traffic controls, and multicloud visibility enforcement.
Insurance
Financial sector component vulnerable to lateral movement and data exfiltration through compromised east-west traffic and inadequate anomaly detection systems.
Capital Markets/Hedge Fund/Private Equity
Critical financial infrastructure at risk from domain spoofing attacks necessitating robust inline IPS protection and cloud-native security fabric deployment.
Sources
- Scattered Spider Resurfaces With Financial Sector Attacks Despite Retirement Claimshttps://thehackernews.com/2025/09/scattered-spider-resurfaces-with.htmlVerified
- Scattered Spider: A Threat Profile | Flashpointhttps://flashpoint.io/blog/scattered-spider-threat-profile/Verified
- Scattered Spider: Threat Actor Profile - Cyblehttps://cyble.com/threat-actor-profiles/scattered-spider/Verified
- Scattered Spider hackers shift focus to aviation, transportation firmshttps://www.bleepingcomputer.com/news/security/scattered-spider-hackers-shift-focus-to-aviation-transportation-firms/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Zero Trust network segmentation, robust egress controls, deep east-west traffic inspection, and real-time threat detection would have significantly curtailed Scattered Spider’s ability to compromise, traverse, and impact cloud environments in the financial sector. CNSF capabilities such as microsegmentation, inline threat prevention, and anomaly-driven response limit attacker movement and expose malicious activity at every stage.
Control: Zero Trust Segmentation
Mitigation: Prevents unauthorized access to cloud workloads by enforcing identity-based access boundaries.
Control: Multicloud Visibility & Control
Mitigation: Enables early detection of suspicious privilege changes through centralized policy and traffic visibility.
Control: East-West Traffic Security
Mitigation: Detects and blocks unauthorized east-west movement between workloads and services.
Control: Threat Detection & Anomaly Response
Mitigation: Rapid detection and alerting on suspicious C2 patterns or unauthorized remote access attempts.
Control: Egress Security & Policy Enforcement
Mitigation: Blocks unapproved data transfers by enforcing outbound traffic filtering and inspection.
Real-time distributed enforcement curtails impact by isolating compromised workloads and automating response.
Impact at a Glance
Affected Business Functions
- Payments
- Customer Data Management
- Online Services
Estimated downtime: 14 days
Estimated loss: $10,000,000
Personal data of 6.5 million members, including names, addresses, emails, phone numbers, and birth dates, were exposed.
Recommended Actions
Key Takeaways & Next Steps
- • Implement zero trust segmentation to prevent untrusted access and minimize attack surface.
- • Enforce granular east-west and egress controls to detect and disrupt lateral movement and data exfiltration.
- • Deploy inline threat detection for rapid identification and response to C2 and anomaly activity.
- • Centralize multicloud visibility and automate policy enforcement to reduce the window of attacker activity.
- • Regularly validate network and identity policies against evolving threat actor TTPs in financial environments.
