Actors/Cybercrime/Americas

Scattered Spider

CRIMEUS · United States

AKA UNC3944 · Octo Tempest · Roasted 0ktapus · Storm-0875 · Muddled Libra · Oktapus · Scattered Swine · Scatter Swine · 0ktapus · Storm-0971 · DEV-0971 · Starfraud

Mandiant: UNC3944Microsoft: Octo Tempest

Native-English-speaking eCrime collective known for social-engineering helpdesks.

Targets3

Sectors3

Threat types1

GIRs covered0/480

Active since2022

Victimology

Geographic footprint · 3 countries

origin · United Statestargeted countries · 3

AMERICAS · 2

Canada · United States

EUROPE · 1

United Kingdom

Sectors targeted

3 of 40

Financial Services61 actors Telecom57 actors Retail & Hospitality25 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

RAN · Ransomware

MITRE ATT&CK · 13 techniques

Reconnaissance · 1

T1589Gather Victim Identity Information

Resource Development · 1

T1583.001Domains

Persistence · 1

T1133External Remote Services

Credential Access · 1

T1539Steal Web Session Cookie

Discovery · 4

T1069Permission Groups Discovery T1069.002Domain Groups

Collection · 2

T1114Email Collection

Command And Control · 1

T1572Protocol Tunneling

Stealth · 2

T1006Direct Volume Access

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Related actors

By origin and actor type

T1082

System Information Discovery

T1580Cloud Infrastructure Discovery

T1530

Data from Cloud Storage

T1564.008

Email Hiding Rules