Scattered Spider
Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted…
- ATT&CK ID
- G1015
- Weather family
- Tempest
- Techniques
- 50
- Tools
- 10
Also tracked as Roasted 0ktapus · Octo Tempest · Storm-0875 · UNC3944
Vulnerabilities it has exploited
Techniques
Reconnaissance
Gather Victim Identity InformationPhishing for Information
Resource Development
Acquire InfrastructureEstablish AccountsObtain Capabilities
Initial Access
Valid AccountsExternal Remote Services
Execution
Command and Scripting InterpreterUser Execution
Persistence
Valid AccountsAccount ManipulationExternal Remote ServicesCreate AccountCreate or Modify System ProcessModify Authentication Process
Privilege Escalation
Exploitation for Privilege EscalationValid AccountsAccount ManipulationDomain or Tenant Policy ModificationCreate or Modify System Process
Stealth
Direct Volume AccessIndicator RemovalValid AccountsHide ArtifactsSocial Engineering
Defense Impairment
Domain or Tenant Policy ModificationSubvert Trust ControlsModify Authentication ProcessModify Cloud Compute InfrastructureDisable or Modify Tools
Credential Access
OS Credential DumpingSteal Web Session CookieUnsecured CredentialsCredentials from Password StoresModify Authentication ProcessMulti-Factor Authentication Request Generation
Discovery
System Network Configuration DiscoveryRemote System DiscoveryPermission Groups DiscoverySystem Information DiscoveryFile and Directory DiscoveryAccount DiscoveryBrowser Information DiscoveryCloud Service DashboardCloud Infrastructure Discovery
Lateral Movement
Collection
Data StagedEmail CollectionData from Information RepositoriesData from Cloud Storage
Command and Control
ProxyIngress Tool TransferRemote Access ToolsProtocol Tunneling
Exfiltration
Exfiltration Over C2 ChannelExfiltration Over Web Service
Impact
Data Encrypted for ImpactInhibit System RecoveryFinancial Theft
Software
BlackCat · ConnectWise · LaZagne · Mimikatz · Raccoon Stealer · Rclone · Tor · Vidar · WarzoneRAT · ngrok