Início / Grupos de ameaça / Scattered Spider

Scattered Spider G1015

🔔 Criar alerta

Também conhecido como: Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944

Atualizado na fonte em 11/09/2026 · Ver no MITRE ATT&CK

2

CVEs associadas

79

Técnicas

10

Malwares e ferramentas

Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors.
Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain.
Scattered Spider had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365.

Operações de ransomware ligadas a este grupo ransomware.live

alphv via BlackCat

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2021-35464 Crítica · 9.8 KEV Ransomware ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability

“C0027: During C0027, Scattered Spider exploited CVE-2021-35464 in the ForgeRock Open Access Management (OpenAM) application server to gain initial access.”

CVE-2015-2291 Alta · 7.8 KEV Ransomware Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability

“Scattered Spider has deployed a malicious kernel driver through exploitation of CVE-2015-2291 in the Intel Ethernet diagnostics driver for Windows (iqvw64.sys).”

Técnicas por tática

Reconhecimento

T1589 Gather Victim Identity Information T1598 Phishing for Information T1598.003 Spearphishing Link T1598.004 Spearphishing Voice

Desenvolvimento de recursos

T1583.001 Domains T1585.001 Social Media Accounts T1588.001 Malware T1588.002 Tool

Acesso inicial

T1078 Valid Accounts T1078.004 Cloud Accounts T1133 External Remote Services

Execução

T1059.001 PowerShell T1059.004 Unix Shell T1204 User Execution

Persistência

T1078 Valid Accounts T1078.004 Cloud Accounts T1098 Account Manipulation T1098.003 Additional Cloud Roles T1133 External Remote Services T1136 Create Account T1543.002 Systemd Service T1556.006 Multi-Factor Authentication T1556.009 Conditional Access Policies

Escalada de privilégios

T1068 Exploitation for Privilege Escalation T1078 Valid Accounts T1078.004 Cloud Accounts T1098 Account Manipulation T1098.003 Additional Cloud Roles T1484.002 Trust Modification T1543.002 Systemd Service

Furtividade

T1006 Direct Volume Access T1070.008 Clear Mailbox Data T1078 Valid Accounts T1078.004 Cloud Accounts T1564.008 Email Hiding Rules T1684.001 Impersonation

Comprometimento de defesas

T1484.002 Trust Modification T1553.002 Code Signing T1556.006 Multi-Factor Authentication T1556.009 Conditional Access Policies T1578.002 Create Cloud Instance T1685 Disable or Modify Tools

Acesso a credenciais

T1003.003 NTDS T1539 Steal Web Session Cookie T1552.001 Credentials In Files T1552.004 Private Keys T1555.005 Password Managers T1556.006 Multi-Factor Authentication T1556.009 Conditional Access Policies T1621 Multi-Factor Authentication Request Generation

Descoberta

T1016 System Network Configuration Discovery T1018 Remote System Discovery T1069 Permission Groups Discovery T1069.002 Domain Groups T1082 System Information Discovery T1083 File and Directory Discovery T1087 Account Discovery T1087.002 Domain Account T1217 Browser Information Discovery T1538 Cloud Service Dashboard T1580 Cloud Infrastructure Discovery

Movimento lateral

T1021.001 Remote Desktop Protocol T1021.004 SSH T1021.007 Cloud Services

Coleta

T1074 Data Staged T1114 Email Collection T1114.003 Email Forwarding Rule T1213.003 Code Repositories T1213.005 Messaging Applications T1530 Data from Cloud Storage

Comando e controle

T1090 Proxy T1105 Ingress Tool Transfer T1219.002 Remote Desktop Software T1572 Protocol Tunneling

Exfiltração

T1041 Exfiltration Over C2 Channel T1567.002 Exfiltration to Cloud Storage

Impacto

T1486 Data Encrypted for Impact T1490 Inhibit System Recovery T1657 Financial Theft

Malwares e ferramentas

BlackCatMalwareS1068
Raccoon StealerMalwareS1148
VidarMalwareS9050
WarzoneRATMalwareS0670
ConnectWiseFerramentaS0591
LaZagneFerramentaS0349
MimikatzFerramentaS0002
ngrokFerramentaS0508
RcloneFerramentaS1040
TorFerramentaS0183

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.