Scattered Spider

Scattered Spider is a financially motivated cybercriminal threat actor active since at least 2022. It is widely tracked under aliases including UNC3944, 0ktapus, Muddled Libra, Scatter Swine, Octo Tempest, Star Fraud, and Storm-0875. The group is notable for aggressive social engineering, especially against large enterprises and outsourced or contracted IT help desks, and for rapidly monetizing access through credential theft, data theft for extortion, and ransomware deployment. Scattered Spider initially became known for targeting telecommunications providers, technology companies, and business process outsourcing firms, including operations associated with SIM swapping and SMS phishing. Its targeting later expanded to hospitality, retail, media and entertainment, financial services, aviation, transportation, and other critical infrastructure-related organizations. High-profile victim reporting has linked the group to incidents affecting Twilio customers and major hospitality brands, and reporting has also associated it with campaigns affecting organizations in the United States and United Kingdom. The actor relies heavily on human-centric intrusion tradecraft. Common initial access methods include smishing, phishing, phone-based impersonation of employees, MFA fatigue, and direct calls to help desks to request password resets or MFA changes. The group commonly gathers personal details about employees to satisfy identity-verification checks and has used residential proxy services to evade location-based security controls. It has also exploited known vulnerabilities, including CVE-2021-35464 and CVE-2015-2291, in some intrusions. Once inside an environment, Scattered Spider conducts broad reconnaissance across Windows, Linux, cloud, and identity platforms, including Azure, Microsoft 365, Google Workspace, and AWS. The group has searched internal documentation, chat systems, and credential storage guidance to support privilege escalation and persistence. It has targeted password managers, privileged access systems, VPN-related data, and MFA enrollment information, and has moved laterally using valid accounts, built-in tools, and additional commodity malware. Scattered Spider frequently abuses legitimate remote access and administration software for persistence and post-compromise operations. It has also obtained and used malware across multiple stages of intrusion, including information stealers, remote access tools, and ransomware. Reported tooling associated with the group includes Vidar and RECORDSTEALER for credential theft and data collection, as well as POORTRY and STONESTOP to disable or terminate security software. The use of signed malicious drivers and other defense-evasion measures demonstrates a willingness to combine social engineering with advanced endpoint tampering. The group is strongly associated with data theft extortion and has also deployed ransomware, including use of BlackCat/ALPHV in some operations. Reporting indicates Scattered Spider evolved from credential theft, SIM swapping, and access-focused crime into broader extortion and ransomware activity by 2023. In ransomware-related incidents, the actor has selectively targeted high-impact systems and has reportedly harassed executives or employees to increase pressure on victims. Scattered Spider is best understood as a fast-moving, English-speaking cybercriminal actor specializing in identity-centric intrusion operations, cloud-aware post-exploitation, and extortion-driven monetization against large enterprises.