FlagThis
← Threat Actors
/
English-speaking regions (primarily US, UK, Canada, and Europe)
/
Scattered Spider
DOSSIER // SCATTERED-SPIDER
Scattered Spider
ACTIVE CAMPAIGN TRACKED
⚠ Critical Threat
English-speaking regions (primarily US, UK, Canada, and Europe)
Primary Aliases:
DEV-0971
Octo Tempest
UNC3944
UNC5537
🔍 Adversary Rosetta Stone (26) ▾
📋 Copy All
Sponsor / State Affiliation
criminal organization
Primary Motivation
financial gain via data extortion, cryptocurrency theft, and ransomware-as-a-service (RaaS) affiliations
Confidence Rating
95% (Grounded)
Marks & Spencer (M&S) Breach, Aviation Sector Targeting, SaaS Phishing Kit #5 Campaign
📥 Export ATT&CK Layer (.json)
🔔 RSS Feed
🛡️ MITRE ATT&CK (G1015) ↗
🏛️ CISA Advisories ↗
📋 Copy Dossier Briefing
⚔️ Weaponized CVE Matrix
(2)
CVE-2021-44228
Log4Shell RCE
CVSS 10.0
KEV
EPSS 97.5%
CVE-2024-21413
Outlook MonikerLink RCE
CVSS 9.8
KEV
EPSS 89.4%
📋 Copy CSV
Tenable Nessus
Qualys / Wiz
🎯 Target Sectors & Focus
Hospitality and Gaming
Retail
Technology and SaaS
Aviation
Insurance
Telecommunications
Financial Services
🛡️ MITRE ATT&CK® Attack Lifecycle
(9 TTPs)
📥 Download Navigator JSON
All Stages
9
Initial Access
2
Execution
1
Credential Access & Discovery
1
Command & Control
1
Exfiltration & Impact
1
Operational Techniques
3
Initial Access
2
T1566
Vishing (Voice Phishing) targeting IT help desks for credential resets
↗
T1566
Phishing and Smishing using fake SSO portals
↗
Execution
1
T1059
Living-off-the-Land (LotL) using PowerShell and PsExec
↗
Credential Access & Discovery
1
T1003
MFA Fatigue (Push Bombing) and SIM swapping
↗
Command & Control
1
T1071
Use of Spectre RAT and infostealers (e.g., StealC V2)
↗
Exfiltration & Impact
1
T1485
Deployment of ransomware variants (DragonForce, ALPHV/BlackCat, Qilin, RansomHub)
↗
Operational Techniques
3
T1000
Identity Provider (IdP) abuse (Okta, Microsoft Entra ID)
↗
T1000
Abuse of Remote Monitoring and Management (RMM) tools (AnyDesk, TeamViewer, ScreenConnect, Tailscale)
↗
T1000
Hypervisor-level attacks on VMware ESXi to dump ntds.dit via unmanaged VMs
↗
📰 Verified Campaigns & Intelligence Archive
🔔 Subscribe to Alerts
[DEEP DIVE]
ShinyHunters Attempt to Compromise ReliaQuest Okta SSO via Vishing and AiTM Phishing
Strategies and Tactics
2026-10-12
[DEEP DIVE]
ShinyHunters Hacker 'Rey' Detained in Jordan Following FBI Recruitment Portal Breach
Attacks and Vulnerabilities
2026-10-03
[DEEP DIVE]
ShinyHunters Targets Salesforce Environments via Sophisticated OAuth Abuse Campaign
Attacks and Vulnerabilities
2026-09-02
[DEEP DIVE]
DentaQuest Data Breach: ShinyHunters Exfiltrates 234 GB of PHI and PII
Attacks and Vulnerabilities
2026-09-01
[DEEP DIVE]
Extradition of Alleged Scattered Spider Member Peter Stokes
Miscellaneous
2026-07-02
[DEEP DIVE]
The Dismantling of Scattered Spider: Tyler Robert Buchanan's Guilty Plea and Identity-Centric Attack Vectors in Cloud and MFA Environments
Attacks and Vulnerabilities
2026-05-24
Adversary Rosetta Stone // Scattered Spider
×
🪟 Microsoft Threat Actor Naming
DEV-0971
📋
Octo Tempest
📋
🔍 Mandiant / Google Threat Intel
UNC3944
📋
UNC5537
📋
UNC6040
📋
UNC6240
📋
🛡️ Other Industry Tracking Codes
0ktapus
📋
Bling Libra
📋
G1015
📋
G1057
📋
Gnostic Players
📋
LUCR-3
📋
Muddled Libra
📋
Oktapus
📋
Roasted 0ktapus
📋
Scatter Swine
📋
Scattered Lapsus Hunters
📋
Scattered LAPSUS$ Hunters
📋
Scattered Swine
📋
ShinyCorp
📋
ShinyHunters
📋
SLH
📋
SLSH
📋
Starfraud
📋
Storm-0875
📋
Storm-0971
📋
Copied to clipboard
SHARE INTELLIGENCE WIRE
×
Story Title
X / Twitter
Bluesky
LinkedIn
Copy Link
LINK COPIED TO CLIPBOARD