Scattered Spider
MISPUnknown
Unknown
Unknown
[Scattered Spider](https://attack.mitre.org/groups/G1015) is a native English-speaking cybercriminal group active since at least 2022. (Citation: CrowdStrike Scattered Spider Profile) (Citation: MSTIC Octo Tempest Operations October 2023) The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. (Citation: MSTIC Octo Tempest Operations October 2023)
[Scattered Spider](https://attack.mitre.org/groups/G1015) relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. (Citation: CISA Scattered Spider Advisory November 2023) (Citation: CrowdStrike Scattered Spider BYOVD January 2023) (Citation: Crowdstrike TELCO BPO Campaign December 2022)
[Scattered Spider](https://attack.mitre.org/groups/G1015) had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. (Citation: Mandiant UNC3944 May 2025)
Tecniche Utilizzate (64)
| ID | ATT&CK | Tattiche |
|---|---|---|
| T1003.003 | NTDS | - |
| T1006 | Direct Volume Access | - |
| T1016 | System Network Configuration Discovery | - |
| T1018 | Remote System Discovery | - |
| T1021.001 | Remote Desktop Protocol | - |
| T1021.004 | SSH | - |
| T1021.007 | Cloud Services | - |
| T1041 | Exfiltration Over C2 Channel | - |
| T1059.001 | PowerShell | - |
| T1059.004 | Unix Shell | - |
| T1068 | Exploitation for Privilege Escalation | - |
| T1069 | Permission Groups Discovery | - |
| T1069.002 | Domain Groups | - |
| T1070.008 | Clear Mailbox Data | - |
| T1074 | Data Staged | - |
Riferimenti (4)
Alias (1446)
Malware Utilizzato (9)
Metadata
| ID: | 430 |
| Created: | 13/01/2026 17:48 |
| Updated: | 06/03/2026 04:00 |