We review vendors based on rigorous testing and research but also take into account your feedback and our affiliate commission with providers. Some providers are owned by our parent company.
Learn more
vpnMentor was established in 2014 to review VPN services and cover privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: Holiday.com, ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.
Advertising Disclosure

vpnMentor was established in 2014 to review VPN services and cover privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: Holiday.com, ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.

Scattered Spider Hits U.S. Companies With Ransomware Attacks

Scattered Spider Hits U.S. Companies With Ransomware Attacks
Andrea Miliani Published on July 31, 2025 Cybersecurity Researcher

The hacker group Scattered Spider has been carrying out aggressive campaigns targeting U.S. companies. In recent attacks, the group has employed sophisticated social engineering techniques to gain access to internal systems of American businesses, enabling them to compromise VMware vCenter Server Appliances (vCSA) and deploy ransomware directly from the hypervisor.

A recent report published by Google Threat Intelligence Group (GTIG) provided more details on Scattered Spider — also known as UNC3944, 0ktapus, and Octo Tempest — and its methodology. The researchers explained that members of the gang typically begin by calling IT help centers and using advanced social engineering tactics to bypass security protocols.

“The actors are aggressive, creative, and particularly skilled at using social engineering to bypass even mature security programs,” wrote Google’s Threat Intelligence Team. “Their attacks are not opportunistic but are precise, campaign-driven operations aimed at an organization's most critical systems and data.”

Scattered Spider has consistently used this methodology in operations targeting the retail sector — the group has also been linked to the major cyberattacks affecting retail companies in the United Kingdom, such as Marks & Spencer and Co-op — and has since expanded to transportation and airline organizations. Earlier this month, the FBI recently warned about the international hacking group’s operations within the aviation industry.

The hackers use a living-off-the-land (LoTL) approach — leveraging existing systems and tools within the company’s network — to manipulate infrastructure. By gaining control of Active Directory, they can access the VMware vSphere environment, where they exfiltrate data and deploy ransomware from the hypervisor.

“This method is highly effective as it generates few traditional indicators of compromise (IoCs) and bypasses security tools like endpoint detection and response (EDR), which often have limited or no visibility into the ESXi hypervisor and vCenter Server Appliance (VCSA),” added Google.

GTIG also shared detailed insights into the anatomy of Scattered Spider’s attacks, along with recommendations and strategies to help organizations prevent future intrusions.

About the Author

Andrea is a seasoned tech journalist with a growing passion for cybersecurity, covering cyberattacks, AI breakthroughs, and the latest trends shaping the future of technology.

Please, comment on how to improve this article. Your feedback matters!

Leave a comment

This field must contain more than 50 characters

The field content should not exceed 1000 letters

Sorry, links are not allowed in this field!

Name should contain at least 3 letters

The field content should not exceed 80 letters

Sorry, links are not allowed in this field!

Special characters are not allowed in the Name field

Please enter a valid email address