UNC5537

ACTIVE CAMPAIGN TRACKED ⚠ Critical Threat United States, United Kingdom, Canada, and Europe

Primary Aliases: DEV-0971 Octo Tempest Scattered Spider UNC3944

Sponsor / State Affiliation Criminal organization (decentralized collective)

Primary Motivation Financial gain through data theft extortion and ransomware deployment

Confidence Rating 95% (Grounded)

DragonForce Ransomware Evolution, Multi-Sector Social Engineering Blitz, Cloud-Native Identity Targeting

🎯 Target Sectors & Focus

Hospitality Telecommunications Technology Aviation Insurance Retail Financial Services Critical Infrastructure

🛡️ MITRE ATT&CK® Attack Lifecycle (10 TTPs)

📥 Download Navigator JSON

Initial Access 1

T1566 Social Engineering (Vishing, Phishing, and Smishing)

Execution 1

T1059 Living-off-the-Land (LotL) techniques

Credential Access & Discovery 2

T1003 MFA Fatigue (Push Bombing)

T1003 SIM Swapping

Exfiltration & Impact 1

T1485 DragonForce Ransomware Deployment

Operational Techniques 5

T1000 Helpdesk Impersonation

T1000 Infostealer Malware (e.g., Lumma Stealer)

T1000 Remote Management Tool (RMM) Abuse (e.g., AnyDesk, ScreenConnect, TeamViewer)

T1000 Hypervisor-level attacks (VMware ESXi)

T1000 Identity Provider (IdP) Compromise (Okta, Azure AD)

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] ShinyHunters Attempt to Compromise ReliaQuest Okta SSO via Vishing and AiTM Phishing

Strategies and Tactics 2026-10-12

[DEEP DIVE] ShinyHunters Hacker 'Rey' Detained in Jordan Following FBI Recruitment Portal Breach

Attacks and Vulnerabilities 2026-10-03

Copied to clipboard

LINK COPIED TO CLIPBOARD