Spanish authorities, in collaboration with the FBI, detained a 22-year-old British man at Palma Airport who is suspected of being the ringleader of the notorious Scattered Spider hacking group. This group has been implicated in high-profile cyber incidents, including a devastating attack on MGM Resorts in 2023 that resulted in a $100 million loss. Unlike traditional cybercrime organizations, Scattered Spider operates more as a collective, employing social engineering tactics like SIM swapping and phishing to infiltrate networks of major companies such as Coinbase and LastPass. The arrest underscores the increasing effectiveness of international law enforcement efforts against cybercriminals who, until recently, have operated with a sense of impunity, hiding behind the anonymity of the internet. This development follows the earlier apprehension of another group affiliate, Noah Urban, in Florida, highlighting a broader crackdown on members of Scattered Spider and associated entities. Further investigation revealed that the apprehended individual in Spain, known under the alias “Tyler,” played a significant role in the group’s operations, specializing in SIM swapping—a technique used to hijack victims’ phone numbers and intercept secure messages. Tyler, identified as Tyler Buchanan from Scotland, is the second member of Scattered Spider to face arrest after Urban. These arrests are part of ongoing efforts to dismantle the group, which has evolved from credential harvesting and SIM swapping to ransomware and data theft extortion schemes. Scattered Spider, also linked to other monikers like 0ktapus and UNC3944, has shifted focus towards encryption-less extortion attacks, targeting software-as-a-service (SaaS) applications to exfiltrate sensitive data. Their sophisticated tactics include leveraging legitimate cloud synchronization utilities and abusing Okta permissions to conduct internal reconnaissance and expand their scope of intrusion. The group’s targeting of CyberArk’s Privileged Access Security solution highlights their methodical approach to compromising corporate networks. CTIX analysts recommend heightened monitoring of SaaS applications, centralizing logs from important services, increasing multi-factor authentication (MFA) re-registrations, and implementing more stringent access policies within cloud tenants.