Scattered Spider
Named by 2 kept items in this workspace.
Search every workspace for Scattered Spider. It matches the name as written, so it can find other things that share it.
The items that name it 2
Abuses the BYOVD technique via CVE-2015-2291 (iqvw64e.sys) to disable EDR from kernel space.
All threat actors in this workspace.