Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. 1 2 The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. 3 Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. 4 5 6 Scattered Spider had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. 7
- CrowdStrike Scattered Spider Profile
- MSTIC Octo Tempest Operations October 2023
- MSTIC Octo Tempest Operations October 2023
- CISA Scattered Spider Advisory November 2023
- CrowdStrike Scattered Spider BYOVD January 2023
- Crowdstrike TELCO BPO Campaign December 2022
- Mandiant UNC3944 May 2025
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1598 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1556.009 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1580 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1484.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.008 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1539 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1538 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1486 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1556.006 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1684.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1219.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1657 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1621 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1530 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1217 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1006 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1490 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1567.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.008 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.007 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1572 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1578.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1003.003 | NTDS | — |
| T1006 | Direct Volume Access | — |
| T1016 | System Network Configuration Discovery | — |
| T1018 | Remote System Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.004 | SSH | — |
| T1021.007 | Cloud Services | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1059.001 | PowerShell | — |
| T1059.004 | Unix Shell | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1069 | Permission Groups Discovery | — |
| T1069.002 | Domain Groups | — |
| T1070.008 | Clear Mailbox Data | — |
| T1074 | Data Staged | — |
| T1078 | Valid Accounts | — |
| T1078.004 | Cloud Accounts | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1087 | Account Discovery | — |
| T1087.002 | Domain Account | — |
| T1090 | Proxy | — |
| T1098 | Account Manipulation | — |
| T1098.003 | Additional Cloud Roles | — |
| T1105 | Ingress Tool Transfer | — |
| T1114 | Email Collection | — |
| T1114.003 | Email Forwarding Rule | — |
| T1133 | External Remote Services | — |
| T1136 | Create Account | — |
| T1204 | User Execution | — |
| T1213.003 | Code Repositories | — |
| T1213.005 | Messaging Applications | — |
| T1217 | Browser Information Discovery | — |
| T1219.002 | Remote Desktop Software | — |
| T1484.002 | Trust Modification | — |
| T1486 | Data Encrypted for Impact | — |
| T1490 | Inhibit System Recovery | — |
| T1530 | Data from Cloud Storage | — |
| T1538 | Cloud Service Dashboard | — |
| T1539 | Steal Web Session Cookie | — |
| T1543.002 | Systemd Service | — |
| T1552.001 | Credentials In Files | — |
| T1552.004 | Private Keys | — |
| T1553.002 | Code Signing | — |
| T1555.005 | Password Managers | — |
| T1556.006 | Multi-Factor Authentication | — |
| T1556.009 | Conditional Access Policies | — |
| T1564.008 | Email Hiding Rules | — |
| T1567.002 | Exfiltration to Cloud Storage | — |
| T1572 | Protocol Tunneling | — |
| T1578.002 | Create Cloud Instance | — |
| T1580 | Cloud Infrastructure Discovery | — |
| T1583.001 | Domains | — |
| T1585.001 | Social Media Accounts | — |
| T1588.001 | Malware | — |
| T1588.002 | Tool | — |
| T1589 | Gather Victim Identity Information | — |
| T1598 | Phishing for Information | — |
| T1598.003 | Spearphishing Link | — |
| T1598.004 | Spearphishing Voice | — |
| T1621 | Multi-Factor Authentication Request Generation | — |
| T1657 | Financial Theft | — |
| T1684.001 | Impersonation | — |
| T1685 | Disable or Modify Tools | — |
别名
Octo Tempest · Roasted 0ktapus · Scattered Spider · Storm-0875 · UNC3944
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。