scattered-spider

• SKILL.mdcore · 20,021 bytes

# Scattered Spider (UNC3944, Octo Tempest, Muddled Libra, Star Fraud) — Adversary Emulation Profile

Scattered Spider (MITRE ATT&CK **G1015**) is a financially motivated, predominantly native English-speaking cybercriminal collective active since at least 2022 and widely linked to the loosely affiliated "The Com" social network. The group is exceptional not for novel malware but for **aggressive, high-tempo social engineering of human identity processes**: it phones and SMS-phishes help desks and employees, impersonates IT staff, bypasses MFA (push bombing, SIM swapping, attacker-registered tokens), and rapidly pivots into cloud identity (Microsoft Entra ID, Okta, AWS, Azure) and virtualization (VMware ESXi/vCenter) before staging data theft and ransomware. It began with the 2022 "0ktapus" Okta-credential phishing wave, escalated to the high-profile 2023 MGM Resorts and Caesars Entertainment intrusions, and through 2024–2025 operated as an affiliate of multiple ransomware-as-a-service brands (BlackCat/ALPHV, RansomHub, Qilin, DragonForce), hitting retail, insurance, and aviation. This profile teaches Decepticon to emulate G1015's signature identity-centric TTPs inside an authorized engagement and helps the blue cell anticipate detection.

## Attribution & motivation

- **Sponsor / nation:** Non-state, criminal. Members are assessed to be primarily young, native English speakers based in the US and UK, affiliated with the broader "The Com" cybercrime community. **Not** a nation-state actor; multiple arrests and a 2025 US extradition have been reported (per Krebs on Security / Infosecurity Magazine).
- **Motivation:** Primarily **financial** — credential theft, SIM-swap fraud / crypto theft, data extortion, and ransomware (`T1657` Financial Theft). There is no credible espionage, destructive-only, or influence mandate; destruction (encryption) is in service of extortion.
- **Confidence:** High confidence the cluster tracked as Scattered Spider = UNC3944 (Mandiant/Google) = Octo Tempest / Storm-0875 (Microsoft) = Muddled Libra (Palo Alto Unit 42) = Roasted 0ktapus = Scatter Swine = Star Fraud. Note these vendor clusters overlap but are not byte-for-byte identical; treat as a fluid affiliate community rather than a fixed roster.

## Targeting

- **Sectors:** Initially telecom, BPO/outsourcing, and CRM/SaaS providers (for SIM-swap and downstream access); from 2023 expanded to hospitality & gaming (casinos), retail, technology/MSP, manufacturing, and **financial services / insurance**; in mid-2025, **aviation**.
- **Regions:** Primarily English-speaking targets — United States, United Kingdom, Canada, Australia — with reporting of expansion toward Singapore and India.