Atlas Actors147 Names508 Sectors40 Requirements480

⌘K

Atlas Actors147 Names508 Sectors40 Requirements480

Actors/Cybercrime/Americas

Scattered Spider

G1015CRIMEUS · United States

AKA UNC3944 · Octo Tempest · Roasted 0ktapus · Storm-0875 · Muddled Libra · Oktapus · Scattered Swine · Scatter Swine · 0ktapus · Storm-0971 · DEV-0971 · Starfraud · Star Fraud · LUCR-3

Mandiant: UNC3944Microsoft: Octo TempestMITRE: G1015

Native-English-speaking eCrime collective known for social-engineering helpdesks.

Targets3

Sectors3

Threat types1

GIRs covered0/480

Active since2022

QUICK FACTS

TypeCybercrime

OriginUnited States

First seen2022

Type (verbatim)eCrime

GIR coverage0/480

TTPs13

Targets3

Sectors3

Last reviewed2026-08-03

Also tracked as

3 vendor names · 12 other aliases

Open Rosetta Stone

Mandiant

UNC3944

Microsoft

Octo Tempest

MITRE

G1015

UNATTRIBUTED ALIASESRoasted 0ktapusStorm-0875Muddled LibraOktapusScattered SwineScatter Swine0ktapusStorm-0971DEV-0971StarfraudStar FraudLUCR-3

Victimology

Geographic footprint · 3 countries

origin · United Statestargeted countries · 3

AMERICAS · 2

Canada · United States

EUROPE · 1

United Kingdom

Sectors targeted

3 of 40

Financial Services74 actors Telecom72 actors Retail & Hospitality33 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

RAN · Ransomware

MITRE ATT&CK · 13 techniques

Reconnaissance · 1

T1589Gather Victim Identity Information

Resource Development · 1

T1583.001Domains

Persistence · 1

T1133External Remote Services

Credential Access · 1

T1539Steal Web Session Cookie

Discovery · 4

T1069Permission Groups Discovery T1069.002Domain Groups

Collection · 2

T1114Email Collection

Command And Control · 1

T1572Protocol Tunneling

Stealth · 2

T1006Direct Volume Access

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer13 techniques · layer format 4.5

Related actors

By origin and actor type

FIN10cybercrime

unattributed · 1 targets · since 2013

FIN2cybercrime

unattributed · 0 targets · since —

FIN6cybercrime

Russia · 15 targets · since 2014

UNC1543cybercrime

unattributed · 22 targets · since —

FIN13cybercrime

unattributed · 4 targets · since 2013

Genesis Pandacybercrime

China · 7 targets · since —

T1082

System Information Discovery

T1580Cloud Infrastructure Discovery

T1530

Data from Cloud Storage

T1564.008

Email Hiding Rules