CybercrimeFinancial gainATT&CK G1015

Scattered Spider

Also known as: Octo Tempest, UNC3944, 0ktapus, Storm-0875

Scattered Spider breaks in by talking, not exploiting. Members phone IT help desks pretending to be employees, persuade staff to reset passwords or MFA, SIM-swap phone numbers and flood users with MFA prompts. Once inside they move into identity providers, cloud consoles and virtualisation platforms, steal data for extortion and have deployed ransomware as affiliates.

Public attribution: Described by MITRE ATT&CK and Microsoft as a native English-speaking cybercriminal group.
Active since: Around 2022
Targets: Telecommunications and business process outsourcing firms
Gaming, hospitality and retail
Technology, financial services and managed service providers

Notable campaigns

2022SMS phishing of telecom and BPO staff
Campaigns, also reported as 0ktapus, harvested credentials and one-time codes to enable SIM swaps.
2023Ransomware affiliate and hospitality attacks
Microsoft reported the group became an ALPHV/BlackCat affiliate in mid-2023; MITRE notes expansion into gaming and hospitality that year.
2023, updated 2025CISA and FBI advisory
AA23-320A described help-desk social engineering, MFA fatigue and SIM swapping; it was updated in July 2025.

Signature ATT&CK techniques

Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.

Defences that work against this actor

Harden help-desk identity checks: no password or MFA reset on a phone call alone; use call-backs to known numbers, manager approval or in-person verification.
Move to phishing-resistant MFA (FIDO2 passkeys) and away from SMS and push approval.
Alert on new MFA device registrations, federation or identity-provider changes and new admin roles.
Allowlist remote access tools and block the rest.
Protect hypervisor and backup consoles with separate admin accounts and MFA.

Learn and practise on CyberCertPrep

Haxplain: phishing Glossary: multi-factor authentication IAM lab

Sources

Notable campaigns

2022SMS phishing of telecom and BPO staff

Campaigns, also reported as 0ktapus, harvested credentials and one-time codes to enable SIM swaps.

2023Ransomware affiliate and hospitality attacks

Microsoft reported the group became an ALPHV/BlackCat affiliate in mid-2023; MITRE notes expansion into gaming and hospitality that year.

2023, updated 2025CISA and FBI advisory

AA23-320A described help-desk social engineering, MFA fatigue and SIM swapping; it was updated in July 2025.

Defences that work against this actor

Harden help-desk identity checks: no password or MFA reset on a phone call alone; use call-backs to known numbers, manager approval or in-person verification.

Move to phishing-resistant MFA (FIDO2 passkeys) and away from SMS and push approval.

Alert on new MFA device registrations, federation or identity-provider changes and new admin roles.

Allowlist remote access tools and block the rest.

Protect hypervisor and backup consoles with separate admin accounts and MFA.