Scattered Spider Help Desk Playbook, Step by Step

What the Federal Complaints Describe

Two criminal complaints made public in 2025 and 2026 give the most detailed public account of the group's help desk method so far. Both are allegations, not convictions.

The more detailed one is the FBI affidavit in United States v. Peter Stokes (N.D. Ill., case 25 CR 812, sworn 16 April 2026). It walks through an intrusion at a luxury jewelry retailer, called Company F, in May 2025:

The calls. The attackers made "several phishing calls" to Company F's IT help desk and asked for a reset of their authentication credentials, "including the password and mobile device for multifactor authentication."
The speed. They "compromised three Company F user accounts within approximately two to three hours."
The jump to admin. Two of the three accounts belonged to IT administrators, and "these users had high-privilege user accounts associated with their standard user accounts." The attackers used those high-privilege accounts "to gain persistent access."
The tunnel. A compromised administrator account was used to install ngrok on a Company F server, which let them get around the network's defenses.
The theft. The affidavit says they took at least 77 gigabytes of data. The Justice Department's announcement of 1 July 2026 adds a ransom demand of about $8 million, which wasn't paid, and losses of at least $2 million.

The second is the complaint against Thalha Jubair (D.N.J., sworn 15 September 2025). It describes the same opening at other victims, including help desk resets that ended with a new multi-factor authentication token added to the account, and it alleges the group was behind at least 120 network intrusions and about $115 million in ransom payments.

Step 3 is the one to read twice. The help desk didn't reset an admin account. It reset two ordinary accounts, and each one led to an admin account that already existed, already had its rights and was ready to use.

Why an MSP Help Desk Is the Bigger Target

The government's own description of the group puts contracted help desks in scope. The joint Scattered Spider advisory from CISA, the FBI and partners including the Canadian Centre for Cyber Security and the RCMP (updated 29 July 2025) says the group targets "large companies and their contracted information technology (IT) help desks." Mandiant's hardening guidance for this group (May 2025) says it goes after organizations with large help desk and outsourced IT functions.

For an MSP, that has two consequences. Your desk takes calls from end users at dozens of clients, most of whom your technicians have never spoken to, so a convincing stranger is the normal case, not the exception. And your technicians often hold admin accounts in many client tenants, which means the "high-privilege account associated with a standard account" pattern from the Stokes affidavit can exist many times over in your own staff directory.

Where the Chain Breaks

Each step in the complaint has a control that stops it. Two of them are help desk and identity controls, and those are where most of the risk sits.

The call: verify before any change. Mandiant's guidance is to verify by on-camera or in-person checks and ID verification, to call back a registered number for high-risk changes, and to avoid relying on publicly available personal data such as date of birth or the last four digits of a national ID. The UK NCSC's advice after the 2025 retail incidents was to review how the help desk authenticates staff before resetting passwords, "especially those with escalated privileges." Our nine-step caller verification procedure turns that into a runbook an L1 technician can follow.
The admin account: give it a stricter path. Two of the three accounts in the Stokes case belonged to IT administrators. Resets for anyone with admin rights should need a second approver and should never be done on a phone call alone.
The jump: leave nothing standing. The step that turned two help desk resets into persistent access was an admin account that was always on. If technician and client admin accounts are disabled until a task needs them, the attacker who takes over the everyday account finds nothing behind it. This is just-in-time admin access, and it's the step that limits the damage when verification fails.
The tunnel: control remote access tools. The advisory recommends allowlisting remote access software and auditing what's installed. That's endpoint and network control, separate from privileged access, and it belongs in your security stack too.
The theft: watch outbound data. Detecting large transfers is a monitoring job for your SIEM or MDR provider. It's the last line, and in the Stokes case it came after 77 gigabytes had already left.

What Phishing-Resistant MFA Does and Doesn't Fix

Phishing-resistant MFA is the advisory's main identity recommendation, and it's the right end state. It stops an attacker who phishes a password and a code. It doesn't stop a technician who resets the MFA method itself, which is exactly what the Company F callers asked for. The reset process is the control that protects MFA, so it needs the same care as the MFA.

That's also why Mandiant suggests turning off self-service MFA resets during periods of elevated threat, and requiring strong authentication before anyone changes an MFA method.

Where This Sits in the PAM Journey

Help desk security touches three of the eight phases of the PAM journey.

Phase 5, enforce MFA and secure access: phishing-resistant MFA on admin accounts, with no SMS fallback, and a verified reset process, because a reset is the easiest way around MFA.
Phase 6, just-in-time access and zero standing privilege: no admin account sits enabled between tasks, so a hijacked standard account doesn't lead anywhere.
Phase 7, audit, monitor and alert: an alert on every reset, new MFA method or enablement on a privileged account, and a weekly review of the verification log.

How CyberQP Handles It

In Panthera today, technicians work from dedicated just-in-time accounts across Active Directory, Entra ID and Microsoft 365. Each account is disabled by default, enabled for the task with an optional second approval, and switched off again automatically, so there's no standing admin account for a reset to reach. Credentials that have to exist are held in a zero-knowledge vault and rotated on a schedule or on demand. CyberQP's help desk identity verification, which checks end users before a password or MFA reset, is available today in QDesk and is coming to Panthera.

A Monday Checklist for Your Desk

List every technician who has a separate admin account in any client tenant, and whether it's enabled right now.
Move those accounts to just-in-time: disabled by default, enabled per task, with approval for sensitive work.
Ban knowledge questions as verification. Verify by a push to the enrolled device, a call-back to the number in your PSA, or an on-camera check.
Require a second approver for any reset on an account with admin rights.
Notify the user and a named client contact of every reset through a separate channel.
Alert on new MFA methods and resets on privileged accounts in every tenant.
Write a surge-mode rule for each client: when they're under attack, self-service MFA reset goes off and every reset goes through the full procedure.

Frequently Asked Questions

Is Octo Tempest the same group as Scattered Spider?

The names overlap. MITRE ATT&CK lists Octo Tempest (Microsoft's name), UNC3944 (Mandiant's) and Roasted 0ktapus among the associated names for Scattered Spider. Vendors track activity differently, so the overlap isn't exact.

Does phishing-resistant MFA stop this attack?

Not on its own. It stops phished codes, but in the Company F case the callers asked the help desk to reset the MFA device itself. A verified reset process is what protects the MFA.

What should a client's staff do when someone calls claiming to be from the MSP?

Treat it the same way in reverse. Hang up and call the MSP back on the number in the contract or on the support portal, not one the caller gives. Mandiant's January 2026 help desk guidance gives the same rule for any caller claiming to be a vendor: end the call, contact the vendor through the account manager on file, and get explicit verification before doing anything.

Should we turn off self-service MFA reset?

Not permanently. Self-service reset that needs a factor the user already holds is safer than a phone call. Mandiant recommends turning it off temporarily during periods of elevated threat, and routing every reset through the help desk procedure until the threat passes.

Were the people charged convicted?

A complaint is an allegation, not a finding of guilt. The Stokes affidavit was sworn on 16 April 2026 and his arrest and extradition were announced on 1 July 2026. The Jubair complaint was sworn on 15 September 2025. Both defendants are presumed innocent unless proven guilty; the court dockets carry the current status.

Sources: United States v. Stokes, N.D. Ill. 25 CR 812, FBI affidavit (16 Apr 2026), paragraphs 21–23; US Department of Justice, Stokes arrest and extradition (1 Jul 2026); United States v. Jubair, D.N.J. complaint (15 Sep 2025); CISA, FBI and partners, Scattered Spider advisory AA23-320A, updated 29 Jul 2025; Mandiant, Defending Against UNC3944 (6 May 2025); Mandiant, Proactive Defense Against ShinyHunters-Branded Data Theft (30 Jan 2026); NCSC, Incidents impacting retailers (4 May 2025); MITRE ATT&CK, Scattered Spider (G1015). All read 6–10 November 2026.