{"type":"bundle","id":"bundle--e9e66867-be56-58d1-8e21-1f4494336022","objects":[{"type":"intrusion-set","id":"intrusion-set--59eb163d-e7e1-594d-933d-83bc913a96eb","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","name":"Scattered Spider","description":"Native-English-speaking eCrime collective known for social-engineering helpdesks.","aliases":["UNC3944","Octo Tempest","Roasted 0ktapus","Storm-0875","Muddled Libra","Oktapus","Scattered Swine","Scatter Swine","0ktapus","Storm-0971","DEV-0971","Starfraud","G1015"],"first_seen":"2022-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/scattered-spider"},{"source_name":"mitre-attack","external_id":"G1015","url":"https://attack.mitre.org/groups/G1015/"}],"labels":["cybercrime","ran"]},{"type":"attack-pattern","id":"attack-pattern--e015ee6a-a756-594e-9d60-48e15ab04cf8","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","name":"Direct Volume Access","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1006","url":"https://attack.mitre.org/techniques/T1006"}]},{"type":"relationship","id":"relationship--51256a64-32da-59e2-9dd2-30aa823ba14a","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","relationship_type":"uses","source_ref":"intrusion-set--59eb163d-e7e1-594d-933d-83bc913a96eb","target_ref":"attack-pattern--e015ee6a-a756-594e-9d60-48e15ab04cf8"},{"type":"attack-pattern","id":"attack-pattern--197c348c-cf59-5bf6-96ee-776b3760358d","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","name":"External Remote Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1133","url":"https://attack.mitre.org/techniques/T1133"}]},{"type":"relationship","id":"relationship--f6db2fb5-8f0c-5add-b59e-89f3a0be441e","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","relationship_type":"uses","source_ref":"intrusion-set--59eb163d-e7e1-594d-933d-83bc913a96eb","target_ref":"attack-pattern--197c348c-cf59-5bf6-96ee-776b3760358d"},{"type":"attack-pattern","id":"attack-pattern--cb0838fe-5178-5cfe-8856-1dd11fb854e3","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","name":"Steal Web Session Cookie","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1539","url":"https://attack.mitre.org/techniques/T1539"}]},{"type":"relationship","id":"relationship--0feb2530-9be4-50df-8329-f3609dd77727","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","relationship_type":"uses","source_ref":"intrusion-set--59eb163d-e7e1-594d-933d-83bc913a96eb","target_ref":"attack-pattern--cb0838fe-5178-5cfe-8856-1dd11fb854e3"},{"type":"attack-pattern","id":"attack-pattern--6e930dfe-b62c-5db1-b523-44f387d9af3f","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","name":"Permission Groups Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1069","url":"https://attack.mitre.org/techniques/T1069"}]},{"type":"relationship","id":"relationship--341469df-ef63-5d3f-91cb-6a3f48d529a0","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","relationship_type":"uses","source_ref":"intrusion-set--59eb163d-e7e1-594d-933d-83bc913a96eb","target_ref":"attack-pattern--6e930dfe-b62c-5db1-b523-44f387d9af3f"},{"type":"attack-pattern","id":"attack-pattern--7a9be69c-fcb0-5141-9c5d-5d60f2a04104","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","name":"Email Collection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1114","url":"https://attack.mitre.org/techniques/T1114"}]},{"type":"relationship","id":"relationship--3d1614b0-14a9-5836-b112-d195399d433c","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","relationship_type":"uses","source_ref":"intrusion-set--59eb163d-e7e1-594d-933d-83bc913a96eb","target_ref":"attack-pattern--7a9be69c-fcb0-5141-9c5d-5d60f2a04104"},{"type":"attack-pattern","id":"attack-pattern--b8a5f033-fd5b-5c3d-a5af-e86fe5ecae79","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","name":"Domain Groups","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1069.002","url":"https://attack.mitre.org/techniques/T1069/002"}]},{"type":"relationship","id":"relationship--9a7ef51f-fa5f-5d4c-99cb-0d59da80e101","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","relationship_type":"uses","source_ref":"intrusion-set--59eb163d-e7e1-594d-933d-83bc913a96eb","target_ref":"attack-pattern--b8a5f033-fd5b-5c3d-a5af-e86fe5ecae79"},{"type":"attack-pattern","id":"attack-pattern--d0791264-dafe-5683-a9a2-5717ffc1d250","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","name":"Email Hiding Rules","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1564.008","url":"https://attack.mitre.org/techniques/T1564/008"}]},{"type":"relationship","id":"relationship--7f5c1638-ccea-5489-9747-2eb0359f9d63","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","relationship_type":"uses","source_ref":"intrusion-set--59eb163d-e7e1-594d-933d-83bc913a96eb","target_ref":"attack-pattern--d0791264-dafe-5683-a9a2-5717ffc1d250"},{"type":"attack-pattern","id":"attack-pattern--078b86ed-d908-5175-a28a-32cbcd1b8c53","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","name":"Data from Cloud Storage","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1530","url":"https://attack.mitre.org/techniques/T1530"}]},{"type":"relationship","id":"relationship--41ceb8f6-8e22-5479-8148-a5be0bcd375c","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","relationship_type":"uses","source_ref":"intrusion-set--59eb163d-e7e1-594d-933d-83bc913a96eb","target_ref":"attack-pattern--078b86ed-d908-5175-a28a-32cbcd1b8c53"},{"type":"attack-pattern","id":"attack-pattern--7ca4bc31-3cbc-5fa2-9a5d-1b7dc17bb602","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","name":"System Information Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1082","url":"https://attack.mitre.org/techniques/T1082"}]},{"type":"relationship","id":"relationship--2ccd61f2-3ea7-56b9-adec-da2b8c102185","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","relationship_type":"uses","source_ref":"intrusion-set--59eb163d-e7e1-594d-933d-83bc913a96eb","target_ref":"attack-pattern--7ca4bc31-3cbc-5fa2-9a5d-1b7dc17bb602"},{"type":"attack-pattern","id":"attack-pattern--987827a2-a9f8-590f-b764-25c8aebc05fd","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","name":"Domains","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.001","url":"https://attack.mitre.org/techniques/T1583/001"}]},{"type":"relationship","id":"relationship--9f558e0e-1b2c-504a-b8cc-353d9d815007","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","relationship_type":"uses","source_ref":"intrusion-set--59eb163d-e7e1-594d-933d-83bc913a96eb","target_ref":"attack-pattern--987827a2-a9f8-590f-b764-25c8aebc05fd"},{"type":"attack-pattern","id":"attack-pattern--a2f67da5-2ccf-5571-9b33-73c2312cf6e3","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","name":"Protocol Tunneling","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1572","url":"https://attack.mitre.org/techniques/T1572"}]},{"type":"relationship","id":"relationship--e42c3eb8-1e45-5d7f-8767-1615b1fa2b9d","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","relationship_type":"uses","source_ref":"intrusion-set--59eb163d-e7e1-594d-933d-83bc913a96eb","target_ref":"attack-pattern--a2f67da5-2ccf-5571-9b33-73c2312cf6e3"},{"type":"attack-pattern","id":"attack-pattern--3f26c6e6-4f57-5f29-b7ad-c8e5d6c82888","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","name":"Gather Victim Identity Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1589","url":"https://attack.mitre.org/techniques/T1589"}]},{"type":"relationship","id":"relationship--93836a63-5ff1-5320-9bb6-6c677c76ba7b","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","relationship_type":"uses","source_ref":"intrusion-set--59eb163d-e7e1-594d-933d-83bc913a96eb","target_ref":"attack-pattern--3f26c6e6-4f57-5f29-b7ad-c8e5d6c82888"},{"type":"attack-pattern","id":"attack-pattern--2d605369-23f7-500b-85a1-712354396c81","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","name":"Cloud Infrastructure Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1580","url":"https://attack.mitre.org/techniques/T1580"}]},{"type":"relationship","id":"relationship--3acf61a6-1ad4-53b6-a338-25e2d20f7ee0","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","relationship_type":"uses","source_ref":"intrusion-set--59eb163d-e7e1-594d-933d-83bc913a96eb","target_ref":"attack-pattern--2d605369-23f7-500b-85a1-712354396c81"},{"type":"location","id":"location--df32d83f-5f4c-5118-a126-3f5c603db260","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","name":"Canada","country":"CA","region":"americas"},{"type":"relationship","id":"relationship--16273a0e-8aca-5d28-8025-b6ce4f1fdd6f","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","relationship_type":"targets","source_ref":"intrusion-set--59eb163d-e7e1-594d-933d-83bc913a96eb","target_ref":"location--df32d83f-5f4c-5118-a126-3f5c603db260"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--56035e40-8dcd-5ae1-9aae-9668272468fc","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","relationship_type":"targets","source_ref":"intrusion-set--59eb163d-e7e1-594d-933d-83bc913a96eb","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--0032f14d-976c-5f37-a365-5d36f69c7416","spec_version":"2.1","created":"2026-05-18T19:45:28.659879+00:00","modified":"2026-07-29T07:06:46.369+00:00","relationship_type":"targets","source_ref":"intrusion-set--59eb163d-e7e1-594d-933d-83bc913a96eb","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}