The Scattered Spider Trilogy: Win, Lose, and Give It Away
- Patrick Duggan
- Jan 8
- 3 min read
Act I: The Win
Target: European Space Agency Haul: 500GB of spacecraft operational data Method: Credential theft, lateral movement, exfiltration Status: "We still have access"
SpaceX, Airbus, Thales Alenia Space contractor data. Satellite failure modes. Contingency plans. The kind of intelligence nation-states pay good money for.
Verdict: WIN
Act II: The Loss
Target: Resecurity Haul: 28,000 consumer records, 190,000 payment transactions Method: Standard reconnaissance and exploitation Plot twist: It was all fake
Resecurity saw them coming. Built a honeypot. Populated it with synthetic data and already-breached records to make it look lived-in. Let them "succeed."
Then dropped the reveal. The "compromised" systems were isolated sandboxes. The "stolen" data was fabricated. The screenshots Scattered Spider posted as proof? Evidence they fell for a trap.
Someone claiming to be "the real ShinyHunters" denied involvement afterward. Sure.
Verdict: LOSS
Act III: The Giveaway
Asset: CVE-2025-61882 (CVSS 9.8) Value: Unauthenticated RCE in Oracle E-Business Suite Distribution method: Posted on "SCATTERED LAPSUS$ HUNTERS" Telegram Price: Free Who profited: Clop
On October 3, 2025, Scattered Spider leaked a working exploit for a critical Oracle vulnerability on their Telegram channel. The next day, Oracle released an emergency patch. Too late—Clop had been using it since August.
Organizations compromised: 103
Datasets on torrent sites: 77
Victims including: Michelin, Canon, Mazda, Estée Lauder, Broadcom, Harvard, Dartmouth
Estimated extortion revenue: Millions
Amount Scattered Spider made from the leak: $0
They did the work. Clop cashed the check.
Verdict: ???
The Pattern
Act | Target | Outcome | Scattered Spider Gets |
I | ESA | 500GB exfiltrated | Nation-state-grade intel |
II | Resecurity | Honeypotted | Embarrassment |
III | Oracle (via leak) | 103 orgs owned | Nothing |
This is the problem with being a "loose alliance" instead of an organized operation. No brand control. No operational security. No monetization strategy.
One faction hits the European Space Agency and walks away with spacecraft data.
Another faction falls for a honeypot and gets publicly embarrassed.
And someone in the group decides to leak a multi-million-dollar exploit for free on Telegram, letting a completely different criminal organization make all the money.
The Comedy
Scattered Spider isn't a threat group. It's a scene.
Different crews using the same name, the same TTPs, and occasionally the same Telegram channels. Some are competent (ESA). Some are sloppy (Resecurity). Some are generous to a fault (Oracle leak).
The left hand doesn't know what the right hand is giving away.
The Tragedy
103 organizations. 77 leaked datasets. 40,000+ people at Dartmouth alone with their SSNs in criminal hands.
Because a threat actor thought Telegram clout was worth more than operational security.
Recommendations
The "Scattered Spider" label covers multiple competence levels
Some will honeypot. Some won't.
Assume they're sharing tools freely—what works on one target will be tried on you
If you have a CVSS 9.8 zero-day, maybe don't post it on Telegram for free
Brand dilution is real—every honeypot embarrassment hurts the name
Clop appreciates your charitable contributions
The Trilogy
Three posts. One day. One group. Three very different outcomes.
Comedy comes in threes.
About DugganUSA: We publish free threat intelligence for the 99% who can't afford enterprise security. Unlike Scattered Spider, we're consistent about what we give away.
Her name is Renee Nicole Good.
Comments