# Scattered Spider

> Adversary-emulation profile for Scattered Spider (UNC3944/Octo Tempest), a financially motivated social-engineering-led intrusion group, mapped to ATT&CK G1015 and Decepticon tooling.

- Skill: `purpleailab/scattered-spider` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/scattered-spider`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/scattered-spider/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/scattered-spider

---


# Scattered Spider (UNC3944, Octo Tempest, Muddled Libra, Star Fraud) — Adversary Emulation Profile

Scattered Spider (MITRE ATT&CK **G1015**) is a financially motivated, predominantly native English-speaking cybercriminal collective active since at least 2022 and widely linked to the loosely affiliated "The Com" social network. The group is exceptional not for novel malware but for **aggressive, high-tempo social engineering of human identity processes**: it phones and SMS-phishes help desks and employees, impersonates IT staff, bypasses MFA (push bombing, SIM swapping, attacker-registered tokens), and rapidly pivots into cloud identity (Microsoft Entra ID, Okta, AWS, Azure) and virtualization (VMware ESXi/vCenter) before staging data theft and ransomware. It began with the 2022 "0ktapus" Okta-credential phishing wave, escalated to the high-profile 2023 MGM Resorts and Caesars Entertainment intrusions, and through 2024–2025 operated as an affiliate of multiple ransomware-as-a-service brands (BlackCat/ALPHV, RansomHub, Qilin, DragonForce), hitting retail, insurance, and aviation. This profile teaches Decepticon to emulate G1015's signature identity-centric TTPs inside an authorized engagement and helps the blue cell anticipate detection.

## Attribution & motivation

- **Sponsor / nation:** Non-state, criminal. Members are assessed to be primarily young, native English speakers based in the US and UK, affiliated with the broader "The Com" cybercrime community. **Not** a nation-state actor; multiple arrests and a 2025 US extradition have been reported (per Krebs on Security / Infosecurity Magazine).
- **Motivation:** Primarily **financial** — credential theft, SIM-swap fraud / crypto theft, data extortion, and ransomware (`T1657` Financial Theft). There is no credible espionage, destructive-only, or influence mandate; destruction (encryption) is in service of extortion.
- **Confidence:** High confidence the cluster tracked as Scattered Spider = UNC3944 (Mandiant/Google) = Octo Tempest / Storm-0875 (Microsoft) = Muddled Libra (Palo Alto Unit 42) = Roasted 0ktapus = Scatter Swine = Star Fraud. Note these vendor clusters overlap but are not byte-for-byte identical; treat as a fluid affiliate community rather than a fixed roster.

## Targeting

- **Sectors:** Initially telecom, BPO/outsourcing, and CRM/SaaS providers (for SIM-swap and downstream access); from 2023 expanded to hospitality & gaming (casinos), retail, technology/MSP, manufacturing, and **financial services / insurance**; in mid-2025, **aviation**.
- **Regions:** Primarily English-speaking targets — United States, United Kingdom, Canada, Australia — with reporting of expansion toward Singapore and India.
- **Victim profile:** Large enterprises with **large outsourced or tiered IT help desks**, heavy reliance on SSO/MFA (Okta, Microsoft Entra ID), significant cloud/SaaS footprint, and VMware-virtualized data centers. The human help desk and identity-recovery workflow is the deliberately chosen weak point.

## Notable campaigns

- **Aug 2022 — "0ktapus" / Roasted 0ktapus:** SMS smishing campaign harvesting Okta credentials and OTPs via ~169 lookalike domains; ~130 organizations compromised, including downstream intrusions at Twilio, Cloudflare (blocked), Mailchimp, DoorDash, and LastPass. (Group-IB, "Roasting 0ktapus.")
- **Sep 2023 — MGM Resorts & Caesars Entertainment:** Help-desk vishing (an employee impersonation reportedly seeded from LinkedIn) granted access; MGM suffered major operational disruption, Caesars reportedly paid a ransom. BlackCat/ALPHV ransomware was associated. (Reuters/CyberScoop reporting; CISA AA23-320A.)
- **Nov 16, 2023 — CISA/FBI Joint Advisory AA23-320A** first published, codifying the group's TTPs. (CISA.)
- **2024 — RaaS affiliate shift:** Following ALPHV's collapse, the group operated with RansomHub and Qilin affiliates.
- **Apr–May 2025 — UK retail wave:** Marks & Spencer (initial access reportedly Feb 2025), Co-op, and Harrods; M&S disruption estimated in the hundreds of millions of GBP, with **DragonForce** ransomware deployed against ESXi. UK arrests of four suspects followed. (The Hacker News; Mandiant/Google.)
- **Jun 2025 — US insurance sector:** Reported intrusions including Philadelphia Insurance Companies and Erie Insurance. (Push Security; Claranet.)
- **Late Jun–Jul 2025 — Aviation:** FBI warned of expansion to airlines; incidents reported at Hawaiian Airlines, WestJet, and Qantas (third-party contact-center platform). (CSO Online.)
- **Jul 29, 2025 — AA23-320A updated** by FBI/CISA + international partners (RCMP, ASD's ACSC, AFP, CCCS, NCSC-UK) with TTPs current to June 2025 and confirmation of DragonForce deployment. (IC3/CISA.)

## TTPs by ATT&CK tactic

### Resource Development
- `T1583.001` Acquire Infrastructure: Domains — registers lookalike/SSO-spoofing domains (e.g. `victim-helpdesk[.]com`, `victim-sso[.]com`).
- `T1585.001` Establish Accounts: Social Media — builds fake personas; uses LinkedIn for target profiling.
- `T1588.001` / `T1588.002` Obtain Capabilities (Malware/Tools) — acquires info-stealers, RATs, ransomware, and offensive tools (RustScan, LinPEAS, aws_consoler, rsocx, Level RMM).
- `T1102` Web Service — stages/downloads tooling from file.io, GitHub, paste.ee.

### Initial Access
- `T1598.004` / `T1566.004` Spearphishing Voice (vishing) — calls help desks/employees impersonating IT to trigger password and MFA resets; signature technique.
- `T1660` / `T1598.003` Phishing (mobile / spearphishing link) — SMS smishing to credential-harvesting portals mimicking SSO.
- `T1598.001` Spearphishing Service — Telegram/Teams messages impersonating IT personnel.
- `T1451` SIM-Card Swap — social-engineers carriers to port victim numbers and intercept SMS OTPs.
- `T1190` Exploit Public-Facing Application — opportunistic (e.g., CVE-2021-35464 in ForgeRock OpenAM).
- `T1133` External Remote Services — abuses VPNs, Citrix, and remote-access tooling for entry.
- `T1078` / `T1078.004` Valid Accounts (incl. Cloud) — logs in with socially-engineered credentials; compromised Entra ID/Azure accounts.
- `T1199` Trusted Relationship — pivots through MSPs, BPOs, and third-party contact-center platforms.
- `T1621` MFA Request Generation — push-bombing / MFA-fatigue until a victim approves.

### Execution
- `T1204` User Execution — directs impersonated victims to install RMM agents.
- `T1219.002` Remote Desktop Software — deploys TeamViewer, AnyDesk, LogMeIn, ConnectWise, ngrok-based access.
- `T1059.001` PowerShell — e.g., `Get-ADUser` and recon scripting.
- `T1059.004` Unix Shell — installs Teleport and tooling on Linux/ESXi.
- `T1047` Windows Management Instrumentation — via Impacket for remote execution/lateral movement.

### Persistence
- `T1098.005` Device Registration — registers attacker MFA devices/endpoints for durable access through VPN.
- `T1136` Create Account — creates new identities in the victim tenant/domain.
- `T1098` / `T1098.001` / `T1098.003` Account Manipulation — adds accounts to privileged groups (e.g., ESX Admins), adds cloud credentials, assigns admin roles.
- `T1556.006` Modify Authentication Process: MFA — registers own MFA tokens post-compromise.
- `T1484.002` Domain Trust Modification — adds a rogue federated IdP to the SSO tenant for backdoor authentication.
- `T1543.002` / `T1547.005` Systemd Service / SSP — Teleport persistence on Linux; Mimikatz SSP.

### Privilege Escalation
- `T1556.009` Conditional Access Policies — adds trusted locations / weakens CA to bypass MFA for controlled accounts.
- `T1068` Exploitation for Privilege Escalation — has deployed a malicious kernel driver (BYOVD via CVE-2015-2291).
- `T1548.002` Bypass UAC — via tooling (BlackCat, WarzoneRAT).

### Defense Evasion
- `T1685` Disable or Modify Tools / `T1562` Impair Defenses — uninstalls/disables EDR and security agents.
- `T1564.008` Email Hiding Rules / `T1070.008` Clear Mailbox Data — auto-deletes vendor security alert emails; deletes traces of its own account activity.
- `T1553.002` Code Signing — abuses self-signed and stolen certificates (e.g., NVIDIA, Global Software LLC).
- `T1027` Obfuscated Files / `T1134` Access Token Manipulation — malware-delivered obfuscation and token abuse.

### Credential Access
- `T1003` / `T1003.003` / `T1003.006` OS Credential Dumping (Mimikatz, LaZagne), NTDS extraction via shadow copies, and DCSync.
- `T1555.005` Password Managers — hunts HashiCorp Vault and PAM solutions.
- `T1539` Steal Web Session Cookie / `T1217` Browser Information — harvests cookies and browser data (Raccoon Stealer).
- `T1552.001` / `T1552.004` Credentials in Files / Private Keys — searches credential docs; exfiltrates code-signing certs.
- `T1684.001` Impersonation — impersonates IT help desk to reset passwords/MFA.
- `T1589` / `T1589.001` Gather Victim Identity Info / Credentials — leverages prior-breach data to pass identity-verification challenges.

### Discovery
- `T1087.002/.003/.004` Account Discovery (Domain/Email/Cloud) — enumerates AD, Entra ID groups and members.
- `T1069.002` / `T1069.003` Permission Groups Discovery — ADExplorer/ADRecon.ps1 for domain groups; Azure AD group membership.
- `T1018` Remote System Discovery — maps vCenter/ESXi infrastructure.
- `T1046` Network Service Discovery — RustScan port scanning.
- `T1082` / `T1016` / `T1083` System/Network/File Discovery — OS fingerprinting, `ping`/`nltest`, hunting MFA docs, network diagrams, and credentials.
- `T1580` / `T1538` Cloud Infrastructure Discovery — enumerates AWS S3 and Systems Manager Inventory.
- `T1213.002/.003/.005` Data from Information Repositories — SharePoint (VPN/MFA enrollment info), internal GitHub repos, Slack/Teams.

### Lateral Movement
- `T1021.001` RDP, `T1021.004` SSH (incl. vCenter), `T1021.007` Cloud Services (EC2/Azure).
- `T1572` Protocol Tunneling — Teleport.sh, Chisel, ngrok, Pinggy, MobaXterm SSH tunnels.
- `T1090` Proxy — proxy networks and rsocx reverse proxy to blend in.

### Collection
- `T1530` Data from Cloud Storage — OneDrive and cloud resources.
- `T1114` / `T1114.003` Email Collection / Forwarding Rule — searches Exchange for incident-response emails and forwards/redirects security alerts.
- `T1074` Data Staged — consolidates stolen data into a central store.

### Command & Control
- RMM tools (`T1219.002`) and tunnelers (`T1572`) double as resilient C2. ngrok (S0508) and Tor (S0183) appear in operations.
- `T1578.002` Modify Cloud Compute Infrastructure — spins up attacker EC2/Azure VMs as staging/C2.

### Exfiltration
- `T1041` Exfiltration Over C2 Channel — via Teleport.
- `T1567.002` Exfiltration to Cloud Storage — MEGA, AWS S3; abuse of cloud DB platforms (e.g., Snowflake tenants). Rclone (S1040) used for cloud transfer.

### Impact
- `T1486` Data Encrypted for Impact — BlackCat/ALPHV and later DragonForce ransomware, notably against VMware ESXi.
- `T1490` Inhibit System Recovery — stops Volume Shadow Copy service.
- `T1006` Direct Volume Access — shadow-copies DC disks to grab NTDS.dit.
- `T1657` Financial Theft — double-extortion: data theft + encryption with leak-site threats.

## Signature tooling & malware

- **Ransomware (RaaS affiliate, not owned):** BlackCat/ALPHV (S1068), DragonForce, RansomHub, Qilin — deployed especially against ESXi.
- **Credential tooling (public):** Mimikatz (S0002), LaZagne (S0349), Impacket (S0357), Raccoon Stealer (S1148).
- **Remote access / RMM (legitimate, abused):** TeamViewer, AnyDesk, LogMeIn, ConnectWise ScreenConnect (S0591), Level RMM, Splashtop, Pulseway.
- **Tunneling / C2:** ngrok (S0508), Chisel, Teleport.sh, Pinggy, rsocx, MobaXterm, Tor (S0183).
- **Recon / cloud:** RustScan, ADExplorer, ADRecon.ps1, SharpHound, LinPEAS, aws_consoler.
- **Exfil:** Rclone (S1040), MEGA client.
- **RATs / drivers:** WarzoneRAT (S0670); BYOVD kernel driver (CVE-2015-2291).
- Hallmark: minimal custom malware — the group weaponizes **legitimate admin/RMM software and identity systems**, making it hard to catch with signature-based detection.

## Emulation guidance (Decepticon)

**Authorized use only:** Execute the below exclusively within the documented rules of engagement and approved scope for this engagement; never SIM-swap real subscribers, social-engineer real third-party carriers/help desks outside scope, or deploy real ransomware against production data.

- **Initial access via identity, not exploits.** Lead with `defense-evasion`/social-engineering playbooks emulating help-desk vishing and SSO smishing (`T1598.004`, `T1660`). Use the phishing/portal-cloning capability to stand up an in-scope lookalike SSO page (`T1583.001`) and harvest test credentials/OTPs. Emulate MFA fatigue (`T1621`) and attacker-MFA-device registration (`T1098.005`, `T1556.006`) against authorized test identities rather than performing a real SIM swap (`T1451` — emulate the OTP-interception outcome with a provisioned test number).
- **Cloud/identity pivot.** Use the **cloud skills** (Azure/Entra + AWS) to emulate G1015's identity tradecraft: enumerate Entra ID/AWS accounts and groups (`T1087.004`, `T1069.003`, `T1580`, `T1538`), add cloud credentials/roles (`T1098.001`, `T1098.003`), weaken Conditional Access / add trusted locations (`T1556.009`), and add a rogue federation trust (`T1484.002`) — all against the engagement's lab/test tenant.
- **AD operations.** Drive the **AD skills**: ADExplorer/SharpHound-style enumeration (`T1069.002`, `T1087.002`), DCSync and NTDS via shadow copy (`T1003.006`, `T1003.003`, `T1006`), Mimikatz/LaZagne dumping (`T1003`). Use **bash/PowerShell** for `Get-ADUser`, `nltest`, and `ping` recon (`T1059.001`, `T1016`).
- **Lateral movement & C2.** Use the **lateral-movement** skill for RDP/SSH/WMI (`T1021.001`, `T1021.004`, `T1047`) and the **c2/Sliver** capability plus **protocol tunneling** (ngrok/Chisel-style, `T1572`, `T1090`) to mirror RMM-and-tunnel C2 (`T1219.002`). Deploy an approved RMM agent to a test host to replicate the signature `T1204`→`T1219.002` chain.
- **Virtualization target.** Where the lab includes VMware, emulate vCenter/ESXi enumeration and SSH access (`T1018`, `T1021.004`) and group manipulation (`T1098`) — stop short of encryption; instead validate that backup/immutability controls would have blocked `T1486`/`T1490`.
- **Collection & exfil simulation.** Stage benign canary data (`T1074`) and exfiltrate to an in-scope cloud bucket via Rclone-style transfer (`T1567.002`) to test DLP/egress controls; emulate inbox-rule evasion (`T1564.008`, `T1114.003`) on a test mailbox.
- **Impact (simulated):** For ransomware emulation, use a benign/inert payload or a detonation-safe simulator against test ESXi/hosts to exercise EDR-disable (`T1685`), shadow-copy deletion (`T1490`), and encryption (`T1486`) detections — never real ransomware on production.

## Detection & defense

- **Identity verification at the help desk:** require strong, out-of-band, on-camera or in-person verification before any password/MFA reset; never rely on DOB/last-4-SSN; temporarily disable self-service MFA resets during active threats. Directly counters `T1598.004`/`T1684.001`.
- **Phishing-resistant MFA:** remove SMS/voice/email factors; deploy FIDO2/number-matching; restrict MFA registration to trusted IPs/compliant devices; alert on the same MFA method registered across multiple users (counters `T1621`, `T1451`, `T1556.006`, `T1098.005`).
- **Entra ID / SSO monitoring:** alert on changes to Conditional Access Policies, Trusted Named Locations, and federation/domain config; verify all federated domains (counters `T1556.009`, `T1484.002`).
- **Detect lookalike domains & smishing portals:** continuous brand/typosquat domain monitoring; user training to reject MFA push-bombing and report IT-impersonation SMS/Teams messages (counters `T1583.001`, `T1660`, `T1598.001`).
- **RMM control:** allow-list approved remote-access software; alert on TeamViewer/AnyDesk/ScreenConnect/ngrok install or execution and outbound to tunneling services (counters `T1219.002`, `T1572`).
- **Teams/collaboration detection:** alert on external-tenant chats with display names containing "help"/"helpdesk" (Mandiant-provided KQL/SecOps rules).
- **Recon tooling:** alert on ADRecon, ADExplorer, SharpHound, RustScan execution; lock down docs containing VPN/MFA-enrollment/network-diagram info (counters discovery cluster).
- **Identity store segregation & Tier-0:** decouple AD from cloud/virtualization/backup identity; local, vault-excluded, MFA-enforced root accounts for ESXi/vCenter; enable ESXi lockdown mode; immutable, network-isolated backups (counters `T1486`, `T1490`, `T1003.x`).
- **Egress restriction & session monitoring:** restrict outbound from DCs/TSI servers; block Tor exit nodes and VPS ranges; alert on impossible-travel, proxy/VPN logins, and token replay (counters C2/exfil cluster).

## Sources

- MITRE ATT&CK — Scattered Spider (G1015): https://attack.mitre.org/groups/G1015/
- Mandiant / Google Cloud — "Defending Against UNC3944: Cybercrime Hardening Guidance from the Frontlines": https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations
- CISA/FBI Joint Advisory AA23-320A — Scattered Spider: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
- CISA alert — "CISA and Partners Release Updated Advisory on Scattered Spider Group" (July 29, 2025): https://www.cisa.gov/news-events/alerts/2025/07/29/cisa-and-partners-release-updated-advisory-scattered-spider-group
- IC3 PDF of AA23-320A (July 29, 2025): https://www.ic3.gov/CSA/2025/250729.pdf
- Group-IB — "Roasting 0ktapus: The phishing campaign going after Okta identity credentials": https://www.group-ib.com/blog/0ktapus/
- The Hacker News — "Scattered Spider Behind Cyberattacks on M&S and Co-op": https://thehackernews.com/2025/06/scattered-spider-behind-cyberattacks-on.html
- CSO Online — "Scattered Spider shifts focus to airlines": https://www.csoonline.com/article/4014787/scattered-spider-shifts-focus-to-airlines-as-strikes-hit-hawaiian-westjet-and-now-qantas.html
- Krebs on Security — "Alleged 'Scattered Spider' Member Extradited to U.S.": https://krebsonsecurity.com/2025/04/alleged-scattered-spider-member-extradited-to-u-s/