NCC: How RaaS team-ups help Scattered Spider enhance its attacks | Computer Weekly

"The notorious Scattered Spider hacking collective behind cyber attacks on Marks & Spencer and others is likely leaning on the expertise of other cyber criminals to enhance the severity of its attacks and the volume of its victims, according to NCC Group's Threat pulse report for August 2025. The gang's attacks this year appear to herald a threat landscape in which collaboration is increasingly the watchword among cyber criminals."

""Scattered Spider is accumulating headlines from its attacks and signature, sophisticated social engineering techniques," said Matt Hull, NCC head of threat intelligence. "But its collaboration with ransomware-as-a-service (RaaS) operators is key in its disruption of global giants. The ransomware landscape operates in a ruthless, business-like structure, which needs to be considered when defences are being implemented." RaaS is the chief method used by the ragtag hacking collective to elevate the sophistication of its attacks so far in 2025, said NCC."

"In leaning on the expertise of others to deliver the more technical aspects of its attacks, its own people - many of them thought to be ordinary teenagers sucked into cyber crime thanks to lax supervision and the influence of online forums - are free to focus on their core social engineering activities. This combo makes Scattered Spider - already an infamous name in cyber circles thanks to a pattern of attacks dating back years - a far more dangerous threat"

Scattered Spider leverages collaborations with ransomware-as-a-service (RaaS) operators to amplify technical sophistication and scale of attacks in 2025. Social engineering specialists within the group, many reportedly ordinary teenagers influenced by online forums and lax supervision, focus on manipulation and credential harvesting while partners supply ransomware delivery and exploit expertise. Working with multiple RaaS affiliates enables the group to adopt varied tools and techniques, increasing victim volume and enabling deeper disruption to global organizations. The partnership model complicates attribution and defensive operations for incident responders and security teams.

Read at ComputerWeekly.com