Scattered Spider
- ID
- G1015
- Associated names
- Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944
- Source
- attack.mitre.org
- MITRE last modified
- 12 Sep 2026
Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. [1] [2] The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. [2]
Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. [3] [4] [5]
Scattered Spider had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. [6]
Techniques used (64)
- T1003.003 NTDS
- T1006 Direct Volume Access
- T1016 System Network Configuration Discovery
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1021.004 SSH
- T1021.007 Cloud Services
- T1041 Exfiltration Over C2 Channel
- T1059.001 PowerShell
- T1059.004 Unix Shell
- T1068 Exploitation for Privilege Escalation
- T1069 Permission Groups Discovery
- T1069.002 Domain Groups
- T1070.008 Clear Mailbox Data
- T1074 Data Staged
- T1078 Valid Accounts
- T1078.004 Cloud Accounts
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1087 Account Discovery
- T1087.002 Domain Account
- T1090 Proxy
- T1098 Account Manipulation
- T1098.003 Additional Cloud Roles
- T1105 Ingress Tool Transfer
- T1114 Email Collection
- T1114.003 Email Forwarding Rule
- T1133 External Remote Services
- T1136 Create Account
- T1204 User Execution
- T1213.003 Code Repositories
- T1213.005 Messaging Applications
- T1217 Browser Information Discovery
- T1219.002 Remote Desktop Software
- T1484.002 Trust Modification
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1530 Data from Cloud Storage
- T1538 Cloud Service Dashboard
- T1539 Steal Web Session Cookie
- T1543.002 Systemd Service
- T1552.001 Credentials In Files
- T1552.004 Private Keys
- T1553.002 Code Signing
- T1555.005 Password Managers
- T1556.006 Multi-Factor Authentication
- T1556.009 Conditional Access Policies
- T1564.008 Email Hiding Rules
- T1567.002 Exfiltration to Cloud Storage
- T1572 Protocol Tunneling
- T1578.002 Create Cloud Instance
- T1580 Cloud Infrastructure Discovery
- T1583.001 Domains
- T1585.001 Social Media Accounts
- T1588.001 Malware
- T1588.002 Tool
- T1589 Gather Victim Identity Information
- T1598 Phishing for Information
- T1598.003 Spearphishing Link
- T1598.004 Spearphishing Voice
- T1621 Multi-Factor Authentication Request Generation
- T1657 Financial Theft
- T1684.001 Impersonation
- T1685 Disable or Modify Tools
Software used (10)
- S0002 Mimikatz
- S0183 Tor
- S0349 LaZagne
- S0508 ngrok
- S0591 ConnectWise
- S0670 WarzoneRAT
- S1040 Rclone
- S1068 BlackCat
- S1148 Raccoon Stealer
- S9050 Vidar