Microsoft has announced targeted updates across its Defender and Sentinel cybersecurity platforms to help customers defend against the rapidly evolving tactics of the Scattered Spider cybercrime group. Known in Microsoft's threat telemetry as 'Octo Tempest', Scattered Spider has escalated its activities in recent months, shifting its targets across sectors including UK retail, insurance, and, most recently, aviation. Notably, the group has become more adaptive in its attack methods, which frequently include social engineering, user impersonation, phishing via SMS, and leveraging advanced tools such as ngrok, Chisel, and AADInternals. Their goal is often to gain access and exfiltrate sensitive data for extortion and ransomware attacks. Recent observations show the group increasingly using DragonForce ransomware, especially against VMware ESX hypervisor environments. Unlike prior attacks focusing first on cloud identities, Scattered Spider now targets both on-premise accounts and infrastructure early in their campaigns, then moves to cloud resources. Microsoft's security teams stress that the group tends to concentrate on one industry for weeks or months before moving to new targets. In response, Microsoft has upgraded Defender's threat detection across endpoints, identities, cloud applications, email, and collaboration tools. Attack disruption features now use advanced intelligence and AI-powered models to contain threats faster. If an account is compromised, Defender can disable it and revoke all active sessions to prevent further access. Additional enhancements include improved hunting tools to help organizations identify high-value individuals at risk of social engineering attempts before an attack begins. Analysts using Microsoft Defender XDR and Sentinel can now query data more deeply and use new exposure management capabilities, including guidance on Scattered Spider's tactics, to strengthen defenses. These steps come as the gang's attacks have been linked to significant incidents across well-known retailers, airlines, and insurance companies, demonstrating the need for constant vigilance and adaptive security tools.