Scattered Spider and BlackCat/ALPHV, notorious for major cyber heists, have resurfaced with new intrusions and possible rebranding over the last few months. Despite arrests of key members in January and June of this year, Scattered Spider, part of a larger cybercriminal community known as “The Com,” continues to target organizations using social engineering, as seen in a recent attack on a manufacturing firm earlier in October 2024. This attack involved help desk manipulation, rapid system encryption, and a ransom demand via Microsoft Teams. The group has also switched to using RansomHub malware, diverging from previous affiliations with BlackCat/ALPHV, and is employing new tactics like advanced defensive evasion and novel Microsoft Teams methods. The resurgence highlights the decentralized nature of these cybercriminal groups, making law enforcement disruptions challenging. Scattered Spider’s operations focus on credential theft and system infiltration through legitimate means, emphasizing the need for stringent help desk policies and technical controls. Meanwhile, BlackCat’s dark web presence was dismantled by an FBI operation in December 2023, but its affiliates have been linked to Cicada3301 ransomware, sharing significant similarities in attack techniques including ransomware written in Rust. Cicada3301 has targeted companies in the US and UK, using tactics akin to BlackCat, such as inhibiting system recovery and embedding PsExec executables. The reemergence of these groups underscores the persistent threat posed by ransomware operators, facilitated by cryptocurrency’s anonymity and geopolitical factors. CTIX analysts urge companies to enhance their cybersecurity posture by investing in robust email filtering, user training, endpoint security, and network monitoring.