MITRE ATT&CKgroup
G1015 Scattered Spider
- Domain
- enterprise, mobile
- Aliases
- Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944
- Version
- 3.0
- Created
- 2023-07-05
Description
Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors.
Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain.
Scattered Spider had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365.
Related
Uses · MITRE ATT&CK (76)
- S9050 Vidar software (malware)
- T1684.001 Impersonation sub-technique
- T1685 Disable or Modify Tools technique
- T1219.002 Remote Desktop Software sub-technique
- T1213.005 Messaging Applications sub-technique
- S1148 Raccoon Stealer software (malware)
- T1556.009 Conditional Access Policies sub-technique
- T1660 Phishing technique
- S0508 ngrok software (tool)
- T1598.004 Spearphishing Voice sub-technique
- T1657 Financial Theft technique
- S1068 BlackCat software (malware)
- T1021.007 Cloud Services sub-technique
- S1040 Rclone software (tool)
- T1070.008 Clear Mailbox Data sub-technique
- T1556.006 Multi-Factor Authentication sub-technique
- T1621 Multi-Factor Authentication Request Generation technique
- S0670 WarzoneRAT software (malware)
- T1564.008 Email Hiding Rules sub-technique
- T1213.003 Code Repositories sub-technique
- S0591 ConnectWise software (tool)
- T1555.005 Password Managers sub-technique
- T1484.002 Trust Modification sub-technique
- T1589 Gather Victim Identity Information technique
- T1598 Phishing for Information technique
- T1598.003 Spearphishing Link sub-technique
- T1585.001 Social Media Accounts sub-technique
- T1588.001 Malware sub-technique
- T1588.002 Tool sub-technique
- T1583.001 Domains sub-technique
Referenced by MITRE ATT&CK · attributed to (1)
- C0027 C0027 campaign
References
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a CISA Scattered Spider Advisory November 2023
- https://www.crowdstrike.com/blog/scattered-spider-attempts-to-avoid-detection-with-bring-your-own-vulnerable-driver-tactic/ CrowdStrike Scattered Spider BYOVD January 2023
- https://www.crowdstrike.com/adversaries/scattered-spider/ CrowdStrike Scattered Spider Profile
- https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944 Mandiant VMware vSphere JUL 2025
- https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations Mandiant UNC3944 May 2025
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide Microsoft Threat Actor Naming July 2023
- https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/ MSTIC Octo Tempest Operations October 2023
- https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/ Crowdstrike TELCO BPO Campaign December 2022