UNC6040

ACTIVE CAMPAIGN TRACKED ▲ High Threat

Primary Aliases: DEV-0971 Octo Tempest Scattered Spider UNC3944

Primary Motivation Financial gain through credential theft, data extortion, and ransom demands

Confidence Rating 85% (Grounded)

Telecom SIM‑Swapping Campaign, SaaS Credential Phishing Wave, Healthcare Data Extortion Operation

🎯 Target Sectors & Focus

Telecommunications Technology Finance Healthcare Cryptocurrency

🛡️ MITRE ATT&CK® Attack Lifecycle (6 TTPs)

📥 Download Navigator JSON

Initial Access 2

T1566 Credential phishing (including MFA bypass via SIM swapping)

T1566 Abuse of legitimate remote access tools (e.g., RDP, VPN)

Credential Access & Discovery 2

T1003 Social engineering via SMS and voice calls

T1003 Use of compromised credentials for lateral movement

Command & Control 1

T1071 Data exfiltration via cloud storage services

Operational Techniques 1

T1000 Extortion and ransom demands

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] ShinyHunters Attempt to Compromise ReliaQuest Okta SSO via Vishing and AiTM Phishing

Strategies and Tactics 2026-10-12

[DEEP DIVE] ShinyHunters Hacker 'Rey' Detained in Jordan Following FBI Recruitment Portal Breach

Attacks and Vulnerabilities 2026-10-03

Copied to clipboard

LINK COPIED TO CLIPBOARD