MITRE ATT&CKcampaign

C0027 C0027

Published 2023-06-30 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.0
Created
2023-06-30

Description

C0027 was a financially-motivated campaign linked to Scattered Spider that targeted telecommunications and business process outsourcing (BPO) companies from at least June through December of 2022. During C0027 Scattered Spider used various forms of social engineering, performed SIM swapping, and attempted to leverage access from victim environments to mobile carrier networks.

Related

Attributed to · MITRE ATT&CK (1)

  • G1015 Scattered Spider group

Uses · MITRE ATT&CK (29)

  • T1684.001 Impersonation sub-technique
  • T1219.002 Remote Desktop Software sub-technique
  • T1566.004 Spearphishing Voice sub-technique
  • T1598.004 Spearphishing Voice sub-technique
  • T1021.007 Cloud Services sub-technique
  • T1621 Multi-Factor Authentication Request Generation technique
  • T1098.005 Device Registration sub-technique
  • T1589.001 Credentials sub-technique
  • T1598.001 Spearphishing Service sub-technique
  • T1588.002 Tool sub-technique
  • T1578.002 Create Cloud Instance sub-technique
  • T1572 Protocol Tunneling technique
  • T1078.004 Cloud Accounts sub-technique
  • T1069.003 Cloud Groups sub-technique
  • T1087.003 Email Account sub-technique
  • T1087.004 Cloud Account sub-technique
  • T1213.002 Sharepoint sub-technique
  • T1003.006 DCSync sub-technique
  • T1098.001 Additional Cloud Credentials sub-technique
  • T1098.003 Additional Cloud Roles sub-technique
  • T1530 Data from Cloud Storage technique
  • S0357 Impacket software (tool)
  • T1190 Exploit Public-Facing Application technique
  • T1046 Network Service Discovery technique
  • T1047 Windows Management Instrumentation technique
  • T1090 Proxy technique
  • T1102 Web Service technique
  • T1105 Ingress Tool Transfer technique
  • T1133 External Remote Services technique

References