Scattered Spider

Overview

Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. Scattered Spider had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365.

Naming & attribution

Scattered Spider is tracked under 5 names across the industry. It uses 64 documented ATT&CK techniques — more than 90% of the 174 groups tracked here. Activity attributed since at least 2022.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1538 Cloud Service Dashboard — used by 1 of 174 groups
• T1556.006 Multi-Factor Authentication — used by 1 of 174 groups
• T1006 Direct Volume Access — used by 2 of 174 groups
• T1070.008 Clear Mailbox Data — used by 2 of 174 groups
• T1204 User Execution — used by 2 of 174 groups
• T1484.002 Trust Modification — used by 2 of 174 groups
• T1556.009 Conditional Access Policies — used by 2 of 174 groups
• T1564.008 Email Hiding Rules — used by 2 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• LAPSUS$ — 21 shared techniques (24% overlap)
• VOID MANTICORE Iran — 22 shared techniques (21% overlap)
• Fox Kitten Iran — 17 shared techniques (19% overlap)
• Storm-0501 — 17 shared techniques (19% overlap)
• Volt Typhoon China — 21 shared techniques (17% overlap)
• Medusa Group — 18 shared techniques (17% overlap)

Capabilities

• Custom malware/implant development — ATT&CK: 3 attributed custom malware families

TTPs — 64 techniques across 14 tactics

Tools & malware (9)

WarzoneRAT · Rclone · LaZagne · Tor · Mimikatz · Raccoon Stealer · ngrok · BlackCat · ConnectWise

Reporting (3)

• From Help Desk to Hypervisor: Defending Your VMware vSphere Estate from UNC3944 — Mandiant Incident Response
• Defending Against UNC3944: Cybercrime Hardening Guidance from the Frontlines — Mandiant Incident Response
• Cybersecurity Advisory: Scattered Spider (AA23-320A) — CISA