Scattered Spider

ACTIVE CAMPAIGN TRACKED ⚠ Critical Threat Unknown (likely English-speaking regions)

Primary Aliases: DEV-0971 Octo Tempest UNC3944 0ktapus

Sponsor / State Affiliation Criminal organization

Primary Motivation Financial gain via extortion and data theft

Active Timeline Unknown – Present

Confidence Rating 95% (Grounded)

MGM/Caesars Hospitality Extortion, Cloud Identity & SaaS Targeting

⚔️ Weaponized CVE Matrix (2)

CVSS 10.0 KEV EPSS 97.5%

Outlook MonikerLink RCE

CVSS 9.8 KEV EPSS 89.4%

🎯 Target Sectors & Focus

Hospitality Technology Gaming/Casinos Finance Telecommunications Critical Infrastructure

🛡️ MITRE ATT&CK® Attack Lifecycle (8 TTPs)

📥 Download Navigator JSON

Initial Access 1

T1566 Social Engineering (Vishing/Phishing)

Persistence & Privilege Escalation 1

T1547 Session Token Theft

Credential Access & Discovery 2

T1003 SIM Swapping

T1003 MFA Fatigue/Push Bombing

Command & Control 1

T1071 Data Exfiltration

Operational Techniques 3

T1000 IT Help Desk Impersonation

T1000 Identity Provider (IdP) Exploitation

T1000 Cloud Infrastructure Compromise (AWS/Azure)

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Extradition of Alleged Scattered Spider Member Peter Stokes

Miscellaneous 2026-07-02

[DEEP DIVE] The Dismantling of Scattered Spider: Tyler Robert Buchanan's Guilty Plea and Identity-Centric Attack Vectors in Cloud and MFA Environments

Attacks and Vulnerabilities 2026-05-24

Copied to clipboard

LINK COPIED TO CLIPBOARD