{
  "id": "scattered-spider",
  "name": "Scattered Spider",
  "aliases": [
    "Roasted 0ktapus",
    "Octo Tempest",
    "Storm-0875",
    "UNC3944"
  ],
  "domain": "cyber",
  "country": "UNK",
  "category": "Cybercriminal group",
  "status": "tracked",
  "fielded": null,
  "operators": [],
  "summary": "Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Native English-speaking cybercriminal group",
      "src": [
        "mitre-g1015"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2022,
      "src": [
        "mitre-g1015"
      ],
      "conf": "medium",
      "note": "At least 2022"
    },
    {
      "k": "attack_id",
      "v": "G1015",
      "src": [
        "mitre-g1015"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors.",
      "src": [
        "mitre-g1015"
      ],
      "conf": "medium"
    },
    {
      "k": "campaigns",
      "v": "C0027 (C0027, 2022–2022)",
      "src": [
        "mitre-g1015"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 64,
      "src": [
        "mitre-g1015"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "BlackCat, ConnectWise, LaZagne, Mimikatz, ngrok, Raccoon Stealer, Rclone, Tor, Vidar, WarzoneRAT",
      "src": [
        "mitre-g1015"
      ],
      "conf": "high",
      "note": "10 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. Scattered Spider had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G1015)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/scattered-spider.html",
  "sources": {
    "mitre-g1015": {
      "title": "Scattered Spider, Group G1015",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G1015/",
      "published": "2026-09-11",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}