# Scattered Spider: threat group profile

> Scattered Spider is a threat group. Public reporting links it to 44 attack techniques. This free profile shows how it works, stage by stage, so you can judge the risk to you. It lists the other names the group goes by and links to every public report behind it.

Canonical page: https://www.edgeprotect.io/threat-actors/scattered-spider
Breadcrumb: [Home](https://www.edgeprotect.io/) > [Threat groups](https://www.edgeprotect.io/threat-actors) > Scattered Spider

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 44 (plus 29 sub-techniques) |
| Thought to operate from | Not known |
| Other names | 10 |
| Public reports | 4 |

## Who is Scattered Spider?

Scattered Spider is a threat group. Public reporting links it to 44 attack techniques.

### Also known as

UNC3944, Muddled Libra, Oktapus, Scattered Swine, Scatter Swine, Octo Tempest, 0ktapus, Storm-0971, DEV-0971, Starfraud

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> Scattered Spider, a highly active hacking group, has made headlines by targeting more than 130 organizations, with the number of victims steadily increasing.

## How does Scattered Spider attack? Stage by stage

Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 44 linked to Scattered Spider. Some techniques belong to more than one stage. Public reporting also lists 29 more specific variations of them, called sub-techniques.

### 1. Research (2)

- T1589: Gather Victim Identity Information
- T1598: Phishing for Information

### 2. Preparation (1)

- T1588: Obtain Capabilities

### 3. Getting in (4)

- T1078: Valid Accounts
- T1133: External Remote Services
- T1190: Exploit Public-Facing Application
- T1566: Phishing

### 4. Running code (2)

- T1047: Windows Management Instrumentation
- T1204: User Execution

### 5. Staying in (5)

- T1078: Valid Accounts
- T1098: Account Manipulation
- T1133: External Remote Services
- T1136: Create Account
- T1556: Modify Authentication Process

### 6. Taking control (4)

- T1068: Exploitation for Privilege Escalation
- T1078: Valid Accounts
- T1098: Account Manipulation
- T1484: Domain or Tenant Policy Modification

### 7. Hiding (4)

- T1006: Direct Volume Access
- T1078: Valid Accounts
- T1564: Hide Artifacts
- T1684: Social Engineering

### 8. Disabling defences (4)

- T1484: Domain or Tenant Policy Modification
- T1553: Subvert Trust Controls
- T1556: Modify Authentication Process
- T1578: Modify Cloud Compute Infrastructure

### 9. Stealing passwords (5)

- T1003: OS Credential Dumping
- T1539: Steal Web Session Cookie
- T1552: Unsecured Credentials
- T1556: Modify Authentication Process
- T1621: Multi-Factor Authentication Request Generation

### 10. Looking around (8)

- T1018: Remote System Discovery
- T1046: Network Service Discovery
- T1069: Permission Groups Discovery
- T1083: File and Directory Discovery
- T1087: Account Discovery
- T1217: Browser Information Discovery
- T1538: Cloud Service Dashboard
- T1580: Cloud Infrastructure Discovery

### 11. Spreading (1)

- T1021: Remote Services

### 12. Gathering data (4)

- T1074: Data Staged
- T1114: Email Collection
- T1213: Data from Information Repositories
- T1530: Data from Cloud Storage

### 13. Keeping contact (5)

- T1090: Proxy
- T1102: Web Service
- T1105: Ingress Tool Transfer
- T1219: Remote Access Tools
- T1572: Protocol Tunneling

### 14. Taking data out (1)

- T1567: Exfiltration Over Web Service

### 15. Causing damage (2)

- T1486: Data Encrypted for Impact
- T1657: Financial Theft

## Public reports about Scattered Spider

- https://www.cybersecurity-insiders.com/scattered-spider-managed-mgm-resort-network-outage-brings-8m-loss-daily/
- https://www.loginradius.com/blog/identity/oktapus-phishing-targets-okta-identity-credentials/
- https://www.attackiq.com/2023/11/21/attack-graph-response-to-cisa-advisory-aa23-320a/
- https://www.mandiant.com/resources/blog/unc3944-sms-phishing-sim-swapping-ransomware

## Frequently asked questions

### Who is Scattered Spider?

Scattered Spider is a threat group. Public reporting links it to 44 attack techniques.

### How does Scattered Spider attack?

Public reporting links Scattered Spider to 44 attack techniques. Most of them are about looking around, staying in and stealing passwords.

### How do I know if Scattered Spider is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free EdgeProtect account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.edgeprotect.io/register
- Book a demo: https://www.edgeprotect.io/contact