Scattered Spider (UNC3944 / Octo Tempest / 0ktapus) continues active operations using social engineering against IT help desk functions to bypass MFA controls and register attacker-controlled devices in identity platforms including Okta and Microsoft Entra ID. The group’s decentralized structure has sustained operations through multiple arrests across two jurisdictions, confirming that law enforcement pressure alone will not arrest operational tempo. No CVE is involved; the attack surface is procedural and identity-layer.