The U.S. Federal Bureau of Investigation (FBI) has struggled to stop a hyper-aggressive cybercrime gang that’s been tormenting corporate America over the last two years, according to nine cybersecurity responders, digital crime experts and victims.

For more than six months, the FBI has known the identities of at least a dozen members tied to the hacking group responsible for the devastating September break-ins at casino operators MGM Resorts International (MGM.N) and Caesars Entertainment (CZR.O), according to four people familiar with the investigation.

Industry executives have told Reuters they were baffled by an apparent lack of arrests despite many of the hackers being based in America.

“I would love for somebody to explain it to me,” said Michael Sentonas, president of CrowdStrike, one of the firms leading the response effort to the hacks.

“For such a small group, they are absolutely causing havoc,” Sentonas told Reuters in an interview last month.

Sentonas said the hackers were “known” but didn’t provide specifics. He did say, “I think there is a failure here.” Asked who was responsible for the failure, Sentonas said, “law enforcement.”

The FBI has said it is investigating the gaming company hacks but a spokesperson for the agency declined to comment on the larger group responsible or where the investigation stands. A spokesman for the Department of Justice also declined to comment.

Dubbed by some security professionals as “Scattered Spider,” the hacking group has been active since 2021 but it grabbed headlines following a series of intrusions at several high profile American companies.

The MGM breach disrupted operations at its casinos and hotels for days and cost the company roughly $100 million in damages, it said in a regulatory filing last month. Caesars paid around $15 million in ransom to regain access to its systems from the hackers, according to reporting by the Wall Street Journal.

Neither company responded to a request for comment.

The sources say that, following the September casino hacks, the FBI’s investigation took on new urgency. FBI officials first began looking at the hackers’ operations more than a year ago.

Security analysts tracking the breaches, meanwhile, have found a range of victims across nearly every industry – starting with telecoms and outsourcing firms to healthcare and financial service companies.

In total, roughly 230 organizations have been hit since the beginning of last year, according to a tally by the Baltimore, Maryland-based cybersecurity firm ZeroFox, which has helped Caesars contain the fallout.

Most of the group’s members are based in Western countries, including the United States, cybersecurity companies say. They typically discuss hacking projects in shared chat channels on social messaging apps, namely Telegram and Discord, which is popular with gamers.

Historically, the group’s amorphous shape made it difficult for the FBI to coordinate internally across its many field offices around the country, said three people familiar with the matter. For months, numerous field offices were each independently investigating individual hacks launched by the same group but were not immediately aware of their connection, delaying the process.

Recently, the FBI’s Newark, New Jersey field office has been handling an investigation into the hacking group and is making progress, according to those three people, who did not provide details. They added that a new special agent have been assigned to the case.

In recent months, meanwhile, alarming details of The Com’s aggressive tactics have come into public view. Its members are engaged in a range of illicit schemes, from sextortion and ransomware to phone-based scams and paying people to commit physical violence – also known as ‘violence-as-a-service.’

In a report published by Microsoft late last month, the tech firm quoted Scattered Spider-linked hackers as threatening to kill employees of a victim organization unless they coughed up passwords.