U.S., Canada, and Australia Update Warning on Scattered Spider Cybercrime Group

On July 29, 2025, the United States, Canada, and Australia issued an updated joint advisory on Scattered Spider, an English-speaking cybercriminal group whose activity has surged in recent months. Financially motivated, the group has recently targeted retail chains and airlines, severely disrupting their operations.

According to the advisory, Scattered Spider has significantly evolved its intrusion techniques, now employing what authorities describe as “multi-layered social engineering.” The hackers systematically gather personal data in order to impersonate employees and trick IT help desks into issuing new credentials. The group is reportedly focused on gaining unauthorized access to victims’ Snowflake database environments.

The alert warns that these tactics are “undermining defenders’ ability to notify targeted organizations or proactively detect intrusions using threat detection tools.” The agencies urge organizations to be especially vigilant regarding unauthorized account use and “suspicious logins.”