D
CyberUnattributed

Scattered Spider

Cybercriminal groupTrackedPending verification

Also known as: Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944

CyberUNK
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeCybercriminal group
Alternative designationsRoasted 0ktapus, Octo Tempest, Storm-0875, UNC3944
ProliferationOrigin country only
Active since2022At least 2022Med[1]
MITRE ATT&CK IDG1015High[1]
Capabilities
ATT&CK techniques used64ATT&CK v20.1High[1]
Malware and toolsBlackCat, ConnectWise, LaZagne, Mimikatz, ngrok, Raccoon Stealer, Rclone, Tor, Vidar, WarzoneRAT10 malware and tool entries linked in ATT&CKHigh[1]
Attribution and activity
Attributed sponsorNative English-speaking cybercriminal groupMed[1]
TargetsThe group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors.Med[1]
Notable activityC0027 (C0027, 2022–2022)Med[1]
Notes
Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. Scattered Spider had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.
Summary

Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
Sources
  1. Scattered Spider, Group G1015, MITRE ATT&CK
    Published/updated 2026-09-11 · Tier 2 · checked 2026-11-08
Change log
  • 2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G1015)