{"id":56590,"date":"2024-07-16T19:01:27","date_gmt":"2024-07-16T19:01:27","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\/"},"modified":"2024-07-16T19:01:27","modified_gmt":"2024-07-16T19:01:27","slug":"cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\/","title":{"rendered":"Cyber-crime super-crew Scattered Spider falls in love with RansomHub and Qilin"},"content":{"rendered":"<p>The Scattered Spider cybercrime group is now using RansomHub and Qilin ransomware variants in its attacks, illustrating a possible power shift among hacking groups.<\/p>\n<p>This is all according to the incident response engagements from the second quarter of the year involving Microsoft, which has described the group as one of the most sophisticated and threatening of its kind currently in operation.<\/p>\n<p>Scattered Spider \u2013 which hit Las Vegas casinos last year <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2023\/09\/15\/scattered_spider_snares_100_victims\/\" rel=\"noopener\">among many other victims<\/a>, and is tracked as Octo Tempest by Microsoft, or the gazillion other aliases it has depending on who&#8217;s doing the talking \u2013 accounts for &#8220;a significant bulk of [Microsoft&#8217;s] investigations.&#8221;&nbsp;<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"condor\" data-xsm=\",fluid,mpu,\" data-sm=\",fluid,mpu,\" data-md=\",fluid,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_specialfeatures\/malwaremonth&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZpbuAy-2MXNtZUxVkm4a0AAAAAI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_specialfeatures\/malwaremonth&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZpbuAy-2MXNtZUxVkm4a0AAAAAI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>Before the Feds crippled it in December, Scattered Spider used to rely on the ransomware payload of ALPHV\/BlackCat \u2013 formerly the biggest dog in the ransomware kennel (along with LockBit) \u2013 so the adoption of RansomHub and Qilin by a group like Scattered Spider demonstrates how seriously the new guard is being taken.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xmd=\",fluid,mpu,leaderboard,\" data-lg=\",fluid,mpu,leaderboard,\" data-xlg=\",fluid,billboard,superleaderboard,mpu,leaderboard,\" data-xxlg=\",fluid,billboard,superleaderboard,brandwidth,brandimpact,leaderboard,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_specialfeatures\/malwaremonth&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44ZpbuAy-2MXNtZUxVkm4a0AAAAAI&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_specialfeatures\/malwaremonth&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44ZpbuAy-2MXNtZUxVkm4a0AAAAAI&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<div class=\"adun_eagle_desktop_story_wrapper\">\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"mid\" data-raptor=\"eagle\" data-xxlg=\",mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_specialfeatures\/malwaremonth&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33ZpbuAy-2MXNtZUxVkm4a0AAAAAI&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_specialfeatures\/malwaremonth&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33ZpbuAy-2MXNtZUxVkm4a0AAAAAI&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<\/p><\/div>\n<p>Microsoft <a href=\"https:\/\/x.com\/MsftSecIntel\/status\/1812932749314978191\" rel=\"nofollow\">said<\/a> in a threat intelligence update\/Xeet this week that RansomHub is being adopted by an ever-increasing number of cybercriminals, including by those who also used to rely on ALPHV&#8217;s malware code. It&#8217;s &#8220;one of the most widespread ransomware families&#8221; in circulation today, Redmond added.<\/p>\n<p>&#8220;Notably, RansomHub was observed being deployed in post-compromise activity by Manatee Tempest following initial access by Mustard Tempest via FakeUpdates\/Socgholish infections,&#8221; Redmond said.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xsm=\",fluid,mpu,\" data-sm=\",fluid,mpu,\" data-md=\",fluid,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_specialfeatures\/malwaremonth&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44ZpbuAy-2MXNtZUxVkm4a0AAAAAI&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_specialfeatures\/malwaremonth&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44ZpbuAy-2MXNtZUxVkm4a0AAAAAI&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>RansomHub first emerged in February 2024 as a <a href=\"https:\/\/www.theregister.com\/2024\/06\/05\/ransomhub_knight_reboot\/\">rebrand<\/a> of the Knight ransomware crew and has claimed responsibility for high-profile attacks on the likes of <a href=\"https:\/\/www.theregister.com\/2024\/06\/10\/christies_clients_data_stolen\/\">Christie&#8217;s<\/a>, <a href=\"https:\/\/www.theregister.com\/2024\/06\/07\/frontier_communications_filing_cyberattack\/\">Frontier Communications<\/a>, and US pharmacy chain <a href=\"https:\/\/www.theregister.com\/2024\/07\/16\/rite_aid_says_22_million\/\">Rite Aid<\/a> since then.<\/p>\n<div class=\"promo_article\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/regmedia.co.uk\/2024\/05\/23\/shutterstock_fbi_scaled.jpg?x=174&amp;amp;y=115&amp;amp;crop=1\" width=\"174\" height=\"115\" alt=\"FBI logo on a billowing flag\"><\/p>\n<h2 title=\"Mandiant CTO chats to The Reg about the looming fate of this ransomware crew\">Casino cyberattacks put a bullseye on Scattered Spider \u2013 and the FBI is closing in<\/h2>\n<p><a href=\"https:\/\/www.theregister.com\/2024\/05\/23\/mandiant_cto_scattered_spider\/\"><span>READ MORE<\/span><\/a><\/div>\n<p>Cybercriminal outfits like RansomHub, <a href=\"https:\/\/www.theregister.com\/2024\/06\/25\/nca_fbi_qilin_ransomware\/\">Qilin<\/a>, <a href=\"https:\/\/www.theregister.com\/2024\/06\/09\/akira_the_next_big_thing\/\">Akira<\/a>, and <a href=\"https:\/\/www.theregister.com\/2024\/03\/08\/swiss_government_files_ransomware\/\">Play<\/a> have stepped in to gobble up the market share left behind by ALPHV\/BlackCat, which <a href=\"https:\/\/www.theregister.com\/2024\/04\/08\/change_healthcare_ransomware\/\">exit scammed<\/a> shortly after receiving its Change Healthcare <a href=\"https:\/\/www.theregister.com\/2024\/03\/04\/alphv_ransom_payment\/\">ransom payment<\/a>, and LockBit \u2013 which still lives on but has largely been abandoned by affiliates since <a href=\"https:\/\/www.theregister.com\/2024\/05\/07\/alleged_lockbit_kingpin_charged_sanctioned\/\">Operation Cronos<\/a> shut parts of the network down.<\/p>\n<p>Microsoft said that BlackSuit, Medusa, and Black Basta were also ransomware families of concern as well.<\/p>\n<h3 class=\"crosshead\">New kids on the block<\/h3>\n<p>RansomHub itself spun up for the first time earlier this year but has already claimed the new number-one spot from its more established competitors. Microsoft is now tracking two newer ransomware families that it says it has cropped up in the past few months.&nbsp;<\/p>\n<p>Fog is one of these variants, the first sightings of which date back to May, <a href=\"https:\/\/arcticwolf.com\/resources\/blog\/lost-in-the-fog-a-new-ransomware-threat\/\" rel=\"nofollow\">according to<\/a> a crew at security shop Arctic Wolf.<\/p>\n<p>In its first month, the team said every one of its victims was based in the US, and the vast majority (80 percent) of attacks targeted the education sector. The other 20 percent hit recreation industries.<\/p>\n<p>Arctic Wolf fell short of it giving it &#8220;ransomware group&#8221; status, as it&#8217;s too new to determine what kind of organizational structure it has. The most popular business model is ransomware-as-a-service (RaaS), so it&#8217;s possible Fog could be its own operation with affiliates, but nothing&#8217;s certain yet.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" id=\"story_eagle_xsm_sm_md_xmd_lg_xlg\" data-pos=\"mid\" data-raptor=\"eagle\" data-xsm=\",mpu,dmpu,\" data-sm=\",mpu,dmpu,\" data-md=\",mpu,dmpu,\" data-xmd=\",mpu,dmpu,\" data-lg=\",mpu,dmpu,\" data-xlg=\",mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_specialfeatures\/malwaremonth&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33ZpbuAy-2MXNtZUxVkm4a0AAAAAI&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_specialfeatures\/malwaremonth&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33ZpbuAy-2MXNtZUxVkm4a0AAAAAI&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>Microsoft first spotted Fog in May as well, but has also attributed its activity to a group tracked as Storm-0844. Microsoft names groups &#8220;Storm&#8221; when they&#8217;re still under development and haven&#8217;t yet formed a clear identity.<\/p>\n<p>That said, Storm-0844 is known to Microsoft as the group that deployed the Akira ransomware strain, and in the two months since Fog entered the scene, Storm-0844 appears to now favor the newer variant over Akira, which is a well-established operation.&nbsp;<\/p>\n<p>This could be based on various factors or a combination of them. More reliable encryption is a possible explanation for the change in tooling, as is the fact that researchers have developed a number of decryptors for Akira ransomware variants. There is also the possibility that Fog offers a better cut of any ransom payments, which is always an attractive prospect for a financially motivated criminal group.<\/p>\n<p>FakePenny ransomware is another of these variants that has emerged in the past quarter, with notable deployers including <a href=\"https:\/\/www.theregister.com\/2024\/05\/29\/north_korea_using_ransomware_and\/\">Moonstone Sleet<\/a>, otherwise known as North Korean state-sponsored scumbags.<\/p>\n<p>Both FakePenny and MoonstoneSleet are fresh faces in the threat landscape, with Microsoft tracking the latter for less than a year. The criminal group has been spotted, in typical fashion for the hermit nation, trying to raise funds by defrauding Western economies through malware and ransomware payments in the region of $6.6 million a pop. \u00ae<\/p>\n<p> READ MORE <a href=\"https:\/\/go.theregister.com\/feed\/www.theregister.com\/2024\/07\/16\/scattered_spider_ransom\/\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Extortionists left hanging after rivals crawled into the woodwork The Scattered Spider cybercrime group is now using RansomHub and Qilin ransomware variants in its attacks, illustrating a possible power shift among hacking groups.\u2026 READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[63],"tags":[],"class_list":["post-56590","post","type-post","status-publish","format-standard","hentry","category-the-register"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Cyber-crime super-crew Scattered Spider falls in love with RansomHub and Qilin 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Cyber-crime super-crew Scattered Spider falls in love with RansomHub and Qilin 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2024-07-16T19:01:27+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_specialfeatures\/malwaremonth&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZpbuAy-2MXNtZUxVkm4a0AAAAAI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Cyber-crime super-crew Scattered Spider falls in love with RansomHub and Qilin\",\"datePublished\":\"2024-07-16T19:01:27+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\\\/\"},\"wordCount\":753,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_specialfeatures\\\/malwaremonth&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZpbuAy-2MXNtZUxVkm4a0AAAAAI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"articleSection\":[\"The Register\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\\\/\",\"name\":\"Cyber-crime super-crew Scattered Spider falls in love with RansomHub and Qilin 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_specialfeatures\\\/malwaremonth&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZpbuAy-2MXNtZUxVkm4a0AAAAAI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"datePublished\":\"2024-07-16T19:01:27+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\\\/#primaryimage\",\"url\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_specialfeatures\\\/malwaremonth&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZpbuAy-2MXNtZUxVkm4a0AAAAAI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"contentUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_specialfeatures\\\/malwaremonth&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZpbuAy-2MXNtZUxVkm4a0AAAAAI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cyber-crime super-crew Scattered Spider falls in love with RansomHub and Qilin\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Cyber-crime super-crew Scattered Spider falls in love with RansomHub and Qilin 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\/","og_locale":"en_US","og_type":"article","og_title":"Cyber-crime super-crew Scattered Spider falls in love with RansomHub and Qilin 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2024-07-16T19:01:27+00:00","og_image":[{"url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_specialfeatures\/malwaremonth&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZpbuAy-2MXNtZUxVkm4a0AAAAAI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Cyber-crime super-crew Scattered Spider falls in love with RansomHub and Qilin","datePublished":"2024-07-16T19:01:27+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\/"},"wordCount":753,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_specialfeatures\/malwaremonth&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZpbuAy-2MXNtZUxVkm4a0AAAAAI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","articleSection":["The Register"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\/","url":"https:\/\/www.threatshub.org\/blog\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\/","name":"Cyber-crime super-crew Scattered Spider falls in love with RansomHub and Qilin 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_specialfeatures\/malwaremonth&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZpbuAy-2MXNtZUxVkm4a0AAAAAI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","datePublished":"2024-07-16T19:01:27+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\/#primaryimage","url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_specialfeatures\/malwaremonth&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZpbuAy-2MXNtZUxVkm4a0AAAAAI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","contentUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_specialfeatures\/malwaremonth&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZpbuAy-2MXNtZUxVkm4a0AAAAAI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/cyber-crime-super-crew-scattered-spider-falls-in-love-with-ransomhub-and-qilin\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Cyber-crime super-crew Scattered Spider falls in love with RansomHub and Qilin"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/56590","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=56590"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/56590\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=56590"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=56590"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=56590"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}