Scattered Spider
Also known asOcto Tempest · Storm-0875 · Muddled Libra · Roasted 0ktapus · Scatter Swine · Starfraud · 0ktapus · LUCR-3 · Oktapus · Scattered Swine
Summary
Financially motivated English-speaking criminal collective — not a single cohesive group but a shared TTP set used across 'The Com' community. Native English fluency enables highly effective vishing/smishing social engineering against IT help desks. CISA/FBI advisory AA23-320A originally published Nov 2023, updated Jul 29 2025 with new TTPs including more sophisticated social engineering and DragonForce ransomware deployment. Jul 2025: CrowdStrike documented escalation across industries, including aviation (Check Point). Apr–May 2025: high-impact retail wave — M&S (£300M profit loss), Co-op (£206M revenue impact, 6.5M customer records), Harrods (CrowdStrike). Mandiant UNC3944 reporting (May 2025): help-desk compromise → VMware vSphere hypervisor persistence for mass VM destruction. Exfiltration to MEGA and Amazon S3 per updated CISA advisory. Microsoft tracks as Octo Tempest with detailed monetisation model analysis. MITRE ATT&CK G1015.
Attribution
Profit-motivated, primarily US and UK members
Criminal or hacktivist group; no state sponsorship established.
- MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Native English-speaking cybercriminal group - US Department of Justice (Government, 2026-07-01)
Charges an alleged member of the criminal hacking group
Campaigns 5
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Aviation Sector TargetingASSESSED | 2025-07 | USA, Canada, Australia | Aviation | Check Point Research (2025-07-07) — Scattered Spider phishing-domain indicators aimed at aviation and enterprise targets |
| Luxury jewelry retailer breach and extortion | 2025-05 | USA | Retail | US DOJ (2026-07-01) — complaint vs Peter Stokes (Operation Riptide): data exfiltrated, ~USD 8M crypto demand in May 2025, actors evicted, no ransom paid, ≥USD 2M loss |
| UK Retail Wave (M&S, Co-op, Harrods)ASSESSED | 2025-04 – 2025-05 | UK | Retail | BleepingComputer (2025-04-29); NCA arrests 2025-07-10 |
| VMware vSphere Hypervisor Attacks | 2025 – 2025-07 | USA, Global | Retail, Aviation, Insurance | Mandiant / GTIG (2025-07-23) — mid-2025 UNC3944 campaign against retail, airline and insurance: help-desk social engineering → vSphere/ESXi hypervisor control |
| MGM Resorts / Caesars EntertainmentASSESSED | 2023-08 – 2023-09 | USA | Hospitality, Gaming | CyberScoop (2023-09-14) — linked to Scattered Spider and ALPHV; who is behind it "remains unclear" |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 16
| Reconnaissance1 | T1598.004Spearphishing Voice |
|---|---|
| Initial Access1 | T1078Valid Accounts |
| Execution1 | T1648Serverless Execution |
| Persistence2 | T1543.002Systemd ServiceT1098Account Manipulation |
| Stealth1 | T1070.008Clear Mailbox Data |
| Credential Access2 | T1621Multi-Factor Authentication Request GenerationT1539Steal Web Session Cookie |
| Discovery2 | T1087Account DiscoveryT1069Permission Groups Discovery |
| Lateral Movement2 | T1534Internal SpearphishingT1550.001Application Access Token |
| Collection1 | T1114.003Email Forwarding Rule |
| Exfiltration1 | T1567.002Exfiltration to Cloud Storage |
| Impact2 | T1486Data Encrypted for ImpactT1657Financial Theft |
Malware and tools 7
| Name | Description | Platform |
|---|---|---|
| DragonForce | Ransomware (RaaS) | Windows |
| ALPHV/BlackCat | Ransomware (RaaS — historical) | Windows |
| RansomHub | Ransomware (RaaS) | Windows/Linux |
| EIGHTBAIT | Phishing Kit (0ktapus) | Web |
| AADInternals | Azure AD Persistence Tool | Windows |
| RattyRat | RAT | Windows |
| Bedevil | Backdoor | Windows |
Exploited vulnerabilities 1
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2015-2291 | 7.8 | Intel Ethernet diagnostics driver (iqvw64.sys) — kernel privilege escalation (BYOVD) (KEV 2023-02-10) |
Highest CVSS first.
Infrastructure patterns
- Domains spoofing corporate login portals, used with adversary-in-the-middle kits (MITRE ATT&CK, 2026)
- RMM tools (TeamViewer, AnyDesk, ngrok) and a teleport reverse shell as C2 (MITRE ATT&CK, 2026; Mandiant, 2025)
- Exfiltration to MEGA and Amazon S3 (CISA, 2025)
Reporting and advisories 7
- CISA/FBI
AA23-320A (Updated Jul 29 2025) — Scattered Spider TTPs - MITRE ATT&CK
G1015 — Scattered Spider - BleepingComputer
UK Retail Wave (M&S, Co-op, Harrods) - Check Point Research
Aviation Sector Targeting - Mandiant / GTIG
VMware vSphere Hypervisor Attacks - CyberScoop
Groups linked to Las Vegas cyber attacks are prolific criminal hacking gangs (MGM / Caesars, Sep 2023) - US DOJ
Luxury jewelry retailer breach and extortion