President Trump signed a national security presidential memorandum on Wednesday directing the National Coordination Center (NCC), part of the Homeland Security Task Force, to build a program that lets vetted private security companies apply for authorization to hack foreign cybercrime organizations. This is offensive action taken at the direction of the U.S. Government, and it is separate from anything a company does to defend its own network. This analysis draws on reporting from BleepingComputer.

The White House frames the target set as transnational criminal organizations behind ransomware, phishing campaigns, financial fraud, sextortion schemes, and impersonation scams. Financially motivated groups such as Scattered Spider, known for social-engineering help desks and hijacking accounts at large enterprises, sit squarely in that category. An alleged member of the group was recently extradited to the United States, which shows the criminal-justice track the program is meant to run alongside.

U.S. consumers reported losing more than $20.8 billion to cyber-enabled crime in 2025, according to the White House.

The structure matters as much as the authorization. Executive directors designated by the Justice and Homeland Security departments will oversee the program, participating firms undergo vetting before signing a contract with one of the two departments, and each company must maintain a bond or escrow of at least $1 million that is forfeited if it breaks the contractual terms. Firms must halt operations immediately and notify the NCC if they find activity exceeding approved limits, including unintended targeting of U.S. citizens or U.S.-based systems.

Reaction from practitioners has been mixed. Veracode co-founder Chris Wysopal called the memo a "pretty big shift in US cyber policy" and "a major expansion of the private sector's role in offensive cyber operations." Former Cyber National Mission Force leader and Automox CTO Jason Kikta described it as "a perpetual motion machine for billable threats."

For your firm, the practical read is that disruption of criminal infrastructure now has a second channel beyond law enforcement takedowns, and the groups on the receiving end are the same ones already targeting mid-market businesses.

Scattered Spider's Attack Methods and Criminal Infrastructure

U.S. consumers reported losing more than $20.8 billion to cyber-enabled crime in 2025, and the White House memo names the specific activity behind that figure: ransomware attacks, phishing campaigns, financial fraud, sextortion schemes, and impersonation scams. Those five categories describe the operating model of financially motivated groups like Scattered Spider more accurately than any malware family does. The money comes from people and accounts, not from exotic exploits.

The attack chain for this class of actor starts with identity, not infrastructure. Phishing and voice-based impersonation (T1566 Phishing, T1656 Impersonation in MITRE ATT&CK) get an attacker a working set of credentials, and multi-factor prompts are handled through repeated push requests or by convincing a help desk to reset the factor outright (T1621 Multi-Factor Authentication Request Generation). No malware has run at this point, which means endpoint controls have nothing to inspect.

What happens next is where most defensive assumptions break. Independent testing data cited alongside the memo makes the gap measurable:

That number matters because overall prevention scores average the easy stage with the hard one. Your stack may block the initial payload reliably and still permit roughly two-thirds of post-authentication activity, since that activity looks like a legitimate employee doing legitimate work.

From there the operation runs on borrowed access rather than custom tooling:

• Valid accounts (T1078) for authentication into VPN concentrators, SSO portals, and cloud consoles, producing successful logins with no failure events preceding them.
• Trusted relationship abuse (T1199), where access obtained at a service provider, contractor, or subsidiary is used to reach the intended victim downstream.
• Account manipulation (T1098) to enroll attacker-controlled MFA devices, add federation trusts, or create service principals that survive a password reset.
• Data exfiltration and extortion, typically targeting customer records, financial data, and credential stores, followed by encryption for impact (T1486) when the victim declines to pay for silence alone.

For a business, the practical consequence is that the first genuine signal is often a billing anomaly in a cloud tenant or a vendor calling about a strange support ticket, well after the intrusion began.

The infrastructure side explains why the memo targets organizations instead of individuals. Criminal groups rent their hosting, and bulletproof hosting providers, whose operators U.S. prosecutors have charged in separate actions, supply the servers that survive abuse complaints and takedown requests. Phishing pages, credential-harvesting portals, and extortion leak sites all sit on that rented capacity, which is rebuilt within days when a single node disappears.

Arrests apply pressure to the people, not the platform. An alleged Scattered Spider member has been extradited to the United States, and the crews such members belong to continue operating because the tooling, hosting, and access brokers remain in place. Disrupting the shared infrastructure, which is what the memo authorizes vetted private firms to attempt under government direction, addresses a layer that individual prosecutions leave standing.

Business and Operational Impact of Scattered Spider Breaches

The federal program targets criminal organizations overseas. It does not change who pays for an intrusion at your company. Notification duties, forensic costs, contract penalties, and lost operating hours stay on your side of the ledger regardless of what any authorized private firm does to the group that hit you.

The financial exposure starts the moment an attacker holds working credentials rather than a foothold on a device. That distinction matters because most security spending is concentrated at the entry point, and testing data shows how much thinner coverage gets afterward.

Translated into your operations, that means the controls you bought to stop intrusion are doing far less work during the phase where data actually leaves. An attacker signed in as a real employee moves through your file shares, ticketing system, and cloud console using permissions you granted on purpose.

What this class of actor takes is chosen for resale value and for pressure during extortion negotiation. In practice that means:

• Customer and account records held in your CRM and billing platforms, including payment details and contact data usable for follow-on fraud
• Employee PII from HR and payroll systems, which triggers notification duties separate from any customer breach
• Financial reporting material, contracts, and pricing files pulled from executive mailboxes and shared drives
• Cloud administrative credentials, API tokens, and password vault contents that extend access into your vendors and clients
• Internal communications used to identify who signs off on payments and who negotiates during an incident

Sector matters for what the downtime costs. In financial services, an outage during settlement or payment processing windows carries direct client impact and regulator attention. In healthcare, systems that hold scheduling, imaging, and claims data drive diversion of patients and delayed billing cycles, and the data involved falls under HIPAA breach notification requirements.

Critical infrastructure operators face a different profile. CISA has warned about cyberattacks disrupting U.S. water utilities, where the operational question is service continuity for a population, not revenue recovery. If you run an operator of that kind, your incident becomes a public safety matter and a public disclosure at the same time.

The compliance bill arrives on a separate track from the technical recovery. Public companies work against SEC material incident disclosure obligations while forensics are still incomplete. Every state where your affected customers live applies its own breach notification statute, so a single stolen customer database can generate parallel obligations across dozens of jurisdictions, each with its own timeline and content requirements.

You are a high-value target if you hold access that reaches other organizations. Managed service providers, payroll processors, law firms, and SaaS platforms all give one set of stolen credentials value well past the first victim, which is why extortion demands scale with your customer list rather than your headcount.

The White House cites ransomware, financial fraud, and impersonation scams as the activity the program is meant to disrupt. Disruption abroad reduces the volume of attempts over time. It does not recover your data, restore your systems, or satisfy a regulator asking why an attacker held valid credentials in your environment for as long as they did.

Detection and Incident Response for Scattered Spider Compromise

If you suspect an identity-driven intrusion, your first move is to revoke active sessions and refresh tokens for every affected account at the same time you reset the password. A password change alone leaves an attacker holding a valid session, and that gap is what turns a contained incident into a second round of access hours later.

Start the hunt at the authentication layer. Pull the last 30 days of VPN and remote access logs and sort by account, source ASN, and device fingerprint rather than by alert severity. The patterns worth your attention are narrow and specific:

• A single account authenticating successfully from a new geography or hosting provider within minutes of a legitimate session from a corporate address.
• Bursts of failed logons (Event ID 4625) against a small set of privileged accounts, followed by one success, which indicates password spraying against valid accounts (T1078).
• Repeated MFA push prompts to one user across a short window, the signature of MFA fatigue attacks (T1621), especially when the user later approves one.
• New MFA methods, phone numbers, or authenticator app registrations added to accounts outside your normal onboarding process (T1098 Account Manipulation).
• Help desk tickets requesting MFA resets or device re-enrollment, cross-referenced against the identity provider's audit log to confirm the request came from the actual employee.

That last item matters more than any signature. Social engineering of the service desk leaves no malware artifact, so your only detection surface is the correlation between a voice call and a directory change. In environments Capstone manages, Adlumin correlates identity provider events with endpoint and VPN telemetry across managed environments, so an MFA re-enrollment followed by a remote logon from an unfamiliar network surfaces as one incident instead of three unrelated log entries.

For lateral movement, watch interactive RDP logons (Event ID 4624, logon type 10) between workstations. Server-to-server and admin-to-server RDP is normal in most networks. Workstation-to-workstation is not, and it is one of the cleanest indicators available to a SOC team without deep packet inspection. Pair that with alerts on newly created local administrator accounts (Event ID 4720) and on the installation of remote monitoring and management tools your IT team did not deploy, since attackers frequently bring their own commercial RMM agent to blend in with legitimate admin traffic.

Containment order matters. Isolate the endpoint before you disable the account, because disabling first tips the attacker while their session stays live on the host. Preserve the identity provider audit log and VPN concentrator logs to separate storage before rotating anything, since many appliances roll those logs on a short window and you will need them for the incident timeline and any notification decisions.

Short-term hardening for the next two weeks: enforce number-matching or FIDO2 hardware keys on all remote access and administrative accounts, remove SMS as a fallback factor, and require a documented callback or manager verification step for any help desk MFA reset. Segment your remote access so that VPN users land in a restricted zone with explicit rules to reach domain controllers and backup infrastructure.

Longer term, build a standing hunt that runs weekly against new admin accounts, new MFA enrollments, and first-time-seen RDP pairs. Tune your EDR to alert on RMM installers and on credential dumping attempts against LSASS, then review those alerts as a queue rather than as noise.

Implications of U.S. Offensive Cyber Operations for Enterprise Defense

The memo creates a contractual channel, not a shield. Vetted security firms sign agreements with the Justice or Homeland Security departments, and the framework explicitly encourages those firms to enter into agreements with other private entities and with federal, state, local, tribal, and territorial agencies to gather threat information on transnational criminal organizations and propose operations against them. If your company has been breached by a group in scope, you are a potential source of that information.

That changes the calculus around incident data. Handing forensic artifacts to the FBI under an existing victim-notification process is a familiar path with known handling rules. Sharing the same artifacts with a private company operating under a government contract is a different transaction, and your incident data almost always contains customer records, employee identifiers, and third-party material you do not own outright.

Before you agree to anything, your counsel needs to see the paper. The questions that matter are narrow: who holds the data after the engagement ends, whether attorney-client privilege over your incident response work product survives the transfer, what your contractual notification duties to customers and partners look like if their data travels with it, and whether any of it crosses a border into a jurisdiction with its own data-protection rules.

Nothing in the memorandum expands what you may do on someone else's systems. Authorization runs to vetted, contracted firms under government direction, with a bond or escrow of at least $1 million that is forfeited for non-compliance. Your own unauthorized access to attacker infrastructure carries the same legal exposure it carried last month, and that distinction is worth restating internally if anyone on your team reads the news as a green light.

Operational timing is the second thing to plan around. The memo directs the program's executive directors and the Homeland Security Council to write the review procedures, so the vetting, contracting, and approval machinery all has to be built before a single operation runs. Treat any near-term reduction in ransomware or fraud pressure as unproven, and hold your security budget where it is.

Expect limited visibility if an operation does touch a group active in your environment. Participating firms must halt immediately on discovering activity beyond approved limits, including unintended targeting of U.S. citizens or U.S.-based systems, and notify the National Coordination Center. You are not in that notification loop. Infrastructure your telemetry has been tracking may go dark without explanation, and command-and-control endpoints you have blocked may change hands or behavior for reasons your analysts cannot reconstruct from logs.

Attribution work gets harder in the same way. If a domain or hosting provider in your indicator list is subject to a disruption effort, the traffic patterns you observe afterward may reflect that effort rather than criminal activity, and your threat intel notes will carry an assumption you cannot verify.

There is also a vendor-evaluation angle. Automox CTO and former Cyber National Mission Force leader Jason Kikta called the arrangement "a perpetual motion machine for billable threats," a reminder that firms with offensive contracts have a commercial interest in the threat volume they report. Veracode co-founder Chris Wysopal called the memo "a major expansion of the private sector's role in offensive cyber operations."

Your disclosure obligations to regulators, insurers, and customers are unchanged. Whatever happens to the group that breached you, the reporting clock and the cost of the incident stay with your organization.

Immediate Actions for Organizations Targeted by Scattered Spider

First 24 hours

Start with your help desk. Lock down the credential reset workflow so no agent can change a password or re-enroll an MFA factor on a privileged account without callback verification to a number already on file, plus manager confirmation. Social-engineering the service desk is the cheapest way into an enterprise, and it costs nothing to close.

Next, pull a list of every account holding domain admin, Entra global admin, VPN administrator, or hypervisor console rights. Most organizations find more of these than they expected, including service accounts and long-forgotten contractor logins. Reset them in one coordinated pass and disable the ones nobody can name an owner for.

Then fix the second factor on those accounts. Move privileged users to FIDO2 hardware keys or certificate-based authentication, and remove SMS and voice callback as fallback options entirely. A fallback factor an attacker can socially engineer makes the strong factor irrelevant.

Finish the day by reviewing which MFA devices were enrolled in the past month and which VPN and RDP sessions are currently live. Unexplained enrollments and long-running sessions from unfamiliar devices are the two findings worth escalating before you go home.

First week

Turn to your identity plumbing, because that is where quiet persistence lives. Check your SSO tenant for new federation trusts, added or replaced SAML signing certificates, newly registered enterprise applications, and OAuth consents granted to apps you do not recognize. Also check cloud accounts for new API keys, service principals, and IAM users created outside your normal provisioning process.

Get legal and compliance involved this week rather than after a finding forces it. Have counsel scope the forensic engagement so work product is covered by privilege, confirm which customer and regulator notification clocks your contracts trigger, and name one person who is authorized to decide what artifacts leave the building and to whom.

• Confirm you have an incident response retainer with named hours, and know the phone number to activate it outside business hours.
• Ask your threat intelligence provider or MDR partner whether your corporate domains and employee credentials appear in recent infostealer collections.
• Review mailbox rules across executive and finance accounts for auto-forwarding or deletion rules added without a ticket.
• Verify that logging from your VPN concentrator, identity provider, and cloud control plane is actually reaching your SIEM with retention past 90 days.

First 30 days

Segment the administrative tier. Administrative work should happen from dedicated jump hosts, workstation-to-workstation RDP and SMB should be blocked by default, and management interfaces for backup systems and hypervisors should sit behind their own access control rather than on the flat user network. This is the control that limits how far one compromised account travels.

SentinelOne runs with tamper protection enforced across managed environments, requiring a passphrase to uninstall the agent and alerting when an endpoint stops reporting. Attackers who reach a server routinely try to disable endpoint protection first, so agent-offline alerts deserve the same urgency as a malware detection.

Close the month with a two-hour tabletop exercise that includes your help desk staff, not only IT and security. Run the scenario where a caller claiming to be a locked-out executive pressures an agent for an MFA reset, and see whether your new verification rule survives contact with an impatient voice. Document where it broke, fix that, and repeat it next quarter.