← Back to Actors
Scattered Spider
Scattered SpiderRoasted 0ktapusOcto TempestStorm-0875UNC3944
[Scattered Spider](https://attack.mitre.org/groups/G1015) is a native English-speaking cybercriminal group active since at least 2022. (Citation: CrowdStrike Scattered Spider Profile) (Citation: MSTIC Octo Tempest Operations October 2023) The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. (Citation: MSTIC Octo Tempest Operations October 2023) [Scattered...
66
Techniques
62
Covered
4
Gaps
94%
Coverage
Coverage62/66
GAPS (4)
COVERED (62)
T1003.003NTDS36 det.T1006Direct Volume Access8 det.T1016System Network Configuration Discovery41 det.T1018Remote System Discovery52 det.T1021.001Remote Desktop Protocol55 det.T1021.004SSH38 det.T1021.007Cloud Services12 det.T1041Exfiltration Over C2 Channel32 det.T1059.001PowerShell384 det.T1059.004Unix Shell177 det.T1068Exploitation for Privilege Escalation104 det.T1069Permission Groups Discovery40 det.T1069.002Domain Groups45 det.T1070.008Clear Mailbox Data10 det.T1074Data Staged12 det.T1078Valid Accounts320 det.T1078.004Cloud Accounts200 det.T1082System Information Discovery91 det.T1083File and Directory Discovery49 det.T1087Account Discovery60 det.T1087.002Domain Account58 det.T1090Proxy50 det.T1098Account Manipulation258 det.T1098.003Additional Cloud Roles60 det.T1105Ingress Tool Transfer199 det.T1114Email Collection18 det.T1114.003Email Forwarding Rule16 det.T1133External Remote Services80 det.T1136Create Account40 det.T1204User Execution92 det.T1213.003Code Repositories9 det.T1217Browser Information Discovery4 det.T1219.002Remote Desktop Software57 det.T1484.002Trust Modification14 det.T1486Data Encrypted for Impact400 det.T1490Inhibit System Recovery65 det.T1530Data from Cloud Storage39 det.T1538Cloud Service Dashboard2 det.T1539Steal Web Session Cookie21 det.T1543.002Systemd Service13 det.T1552.001Credentials In Files62 det.T1552.004Private Keys23 det.T1553.002Code Signing4 det.T1555.005Password Managers4 det.T1556.006Multi-Factor Authentication26 det.T1556.009Conditional Access Policies5 det.T1562.001Disable or Modify Tools332 det.T1564.008Email Hiding Rules9 det.T1567.002Exfiltration to Cloud Storage33 det.T1572Protocol Tunneling62 det.T1578.002Create Cloud Instance4 det.T1580Cloud Infrastructure Discovery31 det.T1583.001Domains69 det.T1588.001Malware2 det.T1588.002Tool13 det.T1589Gather Victim Identity Information1 det.T1598Phishing for Information1205 det.T1598.003Spearphishing Link353 det.T1621Multi-Factor Authentication Request Generation24 det.T1656Impersonation288 det.T1657Financial Theft15 det.T1685Disable or Modify Tools281 det.