CybercrimeMITRE G1015
Scattered Spider
Also known as UNC3944, Muddled Libra, Oktapus, Scattered Swine, Scatter Swine, Octo Tempest, 0ktapus, Storm-0971, DEV-0971, Starfraud, Roasted 0ktapus, Storm-0875
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
Scattered Spider, a highly active hacking group, has made headlines by targeting more than 130 organizations, with the number of victims steadily increasing.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1003.003 NTDST1006 Direct Volume AccessT1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1021.001 Remote Desktop ProtocolT1021.004 SSHT1021.007 Cloud ServicesT1041 Exfiltration Over C2 ChannelT1059.001 PowerShellT1059.004 Unix ShellT1068 Exploitation for Privilege EscalationT1069 Permission Groups DiscoveryT1069.002 Domain GroupsT1070.008 Clear Mailbox DataT1074 Data StagedT1078 Valid AccountsT1078.004 Cloud AccountsT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087 Account DiscoveryT1087.002 Domain AccountT1090 ProxyT1098 Account ManipulationT1098.003 Additional Cloud RolesT1105 Ingress Tool TransferT1114 Email CollectionT1114.003 Email Forwarding RuleT1133 External Remote ServicesT1136 Create AccountT1204 User ExecutionT1213.003 Code RepositoriesT1213.005 Messaging ApplicationsT1217 Browser Information DiscoveryT1219.002 Remote Desktop SoftwareT1451 SIM Card SwapT1484.002 Trust ModificationT1486 Data Encrypted for ImpactT1490 Inhibit System RecoveryT1530 Data from Cloud StorageT1538 Cloud Service DashboardT1539 Steal Web Session CookieT1543.002 Systemd ServiceT1552.001 Credentials In FilesT1552.004 Private KeysT1553.002 Code SigningT1555.005 Password ManagersT1556.006 Multi-Factor AuthenticationT1556.009 Conditional Access PoliciesT1564.008 Email Hiding RulesT1567.002 Exfiltration to Cloud StorageT1572 Protocol TunnelingT1578.002 Create Cloud InstanceT1580 Cloud Infrastructure DiscoveryT1583.001 DomainsT1585.001 Social Media AccountsT1588.001 MalwareT1588.002 ToolT1589 Gather Victim Identity InformationT1598 Phishing for InformationT1598.003 Spearphishing LinkT1598.004 Spearphishing VoiceT1621 Multi-Factor Authentication Request GenerationT1657 Financial TheftT1660 PhishingT1684.001 ImpersonationT1685 Disable or Modify Tools
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.cybersecurity-insiders.com/scattered-spider-managed-mgm-resort-network-outage-brings-8m-loss-daily/
- https://www.loginradius.com/blog/identity/oktapus-phishing-targets-okta-identity-credentials/
- https://www.attackiq.com/2023/11/21/attack-graph-response-to-cisa-advisory-aa23-320a/
- https://www.mandiant.com/resources/blog/unc3944-sms-phishing-sim-swapping-ransomware
- https://attack.mitre.org/groups/G1015
- https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944
- https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
- https://www.crowdstrike.com/adversaries/scattered-spider/
- https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/
- https://www.crowdstrike.com/blog/scattered-spider-attempts-to-avoid-detection-with-bring-your-own-vulnerable-driver-tactic/
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.