According to the US CISA and FBI, the group Scattered Spider targets large companies and their contracted IT helpdesks. Their advisory on the group is one of the clearest warnings that the service desk can be a way in. What does it say, and what does it mean for your organisation?
What is Scattered Spider?
Scattered Spider is the name for a group of cybercriminals that uses social engineering. In November 2023, CISA and the FBI published a joint advisory on the group. On 29 July 2025, the advisory was updated, together with partners from countries including Canada, Australia and the United Kingdom.
What does the advisory say about the helpdesk?
The advisory describes how attackers pose as employees and convince the IT helpdesk to reset passwords or MFA tokens. This gives them access to that employee's account. This is called account takeover via the service desk.
The advisory also mentions the reverse: attackers posing as the helpdesk to employees. In both cases, it comes down to the same question. Are you sure who you are speaking to?
Why this also applies to Dutch organisations
The advisory comes from the United States, but the route it describes is not tied to any one country. Every organisation where the service desk can reset passwords or MFA at a caller's request has the same route. If you have outsourced your service desk, this also applies to that party.
In addition, in the Netherlands it is a board-level issue. Since 15 August 2026, the Cyberbeveiligingswet (the Dutch Cybersecurity Act) has been in force. The board bears ultimate responsibility for cyber risk management, and NIS2 lists access control and multi-factor authentication among the mandatory measures.
What the advisory recommends
- Phishing-resistant MFA. The advisory recommends using phishing-resistant MFA wherever possible, such as FIDO/WebAuthn or PKI-based MFA.
- Keep testing. The advisory recommends exercising, testing and validating the security programme, and doing so continuously in the production environment.
The advisory does not set out a specific method for identity verification at the helpdesk. And phishing-resistant MFA also has to be resettable when someone loses a device. Then the question lands back at the service desk: who is calling?
What can you do?
- Test whether your service desk holds up. An account takeover assessment shows whether your service desk releases an account to someone who calls. Always within signed authorisation.
- Look at where the process leaves room. A process analysis shows where policy and practice diverge.
- Choose technical verification. Technical measures replace the judgement of a single employee with a control that the caller must pass themselves.
