CVE Intelligence
Home / Threat actors / Scattered Spider

Scattered Spider G1015

🔔 Create alert

Also known as: Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944

Updated at source on Sep 11, 2026 · View on MITRE ATT&CK

2
associated CVEs
79
Techniques
10
Malware and tools

Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors.
Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain.
Scattered Spider had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365.

Ransomware operations linked to this group ransomware.live

alphv via BlackCat

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2021-35464 Critical · 9.8 KEV Ransomware ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability
“C0027: During C0027, Scattered Spider exploited CVE-2021-35464 in the ForgeRock Open Access Management (OpenAM) application server to gain initial access.”
CVE-2015-2291 High · 7.8 KEV Ransomware Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability
“Scattered Spider has deployed a malicious kernel driver through exploitation of CVE-2015-2291 in the Intel Ethernet diagnostics driver for Windows (iqvw64.sys).”

Techniques by tactic

Reconnaissance
T1589 Gather Victim Identity InformationT1598 Phishing for InformationT1598.003 Spearphishing LinkT1598.004 Spearphishing Voice
Resource Development
T1583.001 DomainsT1585.001 Social Media AccountsT1588.001 MalwareT1588.002 Tool
Initial Access
T1078 Valid AccountsT1078.004 Cloud AccountsT1133 External Remote Services
Execution
T1059.001 PowerShellT1059.004 Unix ShellT1204 User Execution
Persistence
T1078 Valid AccountsT1078.004 Cloud AccountsT1098 Account ManipulationT1098.003 Additional Cloud RolesT1133 External Remote ServicesT1136 Create AccountT1543.002 Systemd ServiceT1556.006 Multi-Factor AuthenticationT1556.009 Conditional Access Policies
Privilege Escalation
T1068 Exploitation for Privilege EscalationT1078 Valid AccountsT1078.004 Cloud AccountsT1098 Account ManipulationT1098.003 Additional Cloud RolesT1484.002 Trust ModificationT1543.002 Systemd Service
Stealth
T1006 Direct Volume AccessT1070.008 Clear Mailbox DataT1078 Valid AccountsT1078.004 Cloud AccountsT1564.008 Email Hiding RulesT1684.001 Impersonation
Defense Impairment
T1484.002 Trust ModificationT1553.002 Code SigningT1556.006 Multi-Factor AuthenticationT1556.009 Conditional Access PoliciesT1578.002 Create Cloud InstanceT1685 Disable or Modify Tools
Credential Access
T1003.003 NTDST1539 Steal Web Session CookieT1552.001 Credentials In FilesT1552.004 Private KeysT1555.005 Password ManagersT1556.006 Multi-Factor AuthenticationT1556.009 Conditional Access PoliciesT1621 Multi-Factor Authentication Request Generation
Discovery
T1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1069 Permission Groups DiscoveryT1069.002 Domain GroupsT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087 Account DiscoveryT1087.002 Domain AccountT1217 Browser Information DiscoveryT1538 Cloud Service DashboardT1580 Cloud Infrastructure Discovery
Lateral Movement
T1021.001 Remote Desktop ProtocolT1021.004 SSHT1021.007 Cloud Services
Collection
T1074 Data StagedT1114 Email CollectionT1114.003 Email Forwarding RuleT1213.003 Code RepositoriesT1213.005 Messaging ApplicationsT1530 Data from Cloud Storage
Command and Control
T1090 ProxyT1105 Ingress Tool TransferT1219.002 Remote Desktop SoftwareT1572 Protocol Tunneling
Exfiltration
T1041 Exfiltration Over C2 ChannelT1567.002 Exfiltration to Cloud Storage
Impact
T1486 Data Encrypted for ImpactT1490 Inhibit System RecoveryT1657 Financial Theft

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.