Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Scattered Spider · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

Scattered Spider

  • UNC3944
  • Muddled Libra
  • Oktapus
  • Scattered Swine
  • Scatter Swine
  • Octo Tempest
  • 0ktapus
  • Storm-0971

MITRE G1015 ↗

Scattered Spider — ATT&CK roseSS

attack rose · 64 techniques across 14 tactics

Last 30 days

last seen 29 d ago
dispatch1
victims0
CVEs seen0

What changed

ledger · newest first
  1. —todaynew CVE2 new CVEs: CVE-2015-2291, CVE-2021-35464
  2. —27 d agoresurfacedback on the wire — nothing in the previous 30 days

Analyst brief

misp-galaxy + mitre-attack

Scattered Spider, a highly active hacking group, has made headlines by targeting more than 130 organizations, with the number of victims steadily increasing.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

64 techniques · 14 of 15 tactics

  1. Reconnaissance

    4 techniques

  2. Resource development

    4 techniques

  3. Execution

    3 techniques

  4. Persistence

    5 techniques

  5. Privilege escalation

    1 technique

  6. Stealth

    6 techniques

  7. Defense impairment

    6 techniques

  8. Credential access

    6 techniques

  9. Discovery

    11 techniques

  10. Lateral movement

    3 techniques

  11. Collection

    6 techniques

  12. Command and control

    4 techniques

  13. Exfiltration

    2 techniques

  14. Impact

    3 techniques

select a technique

Arsenal

3 malware · 6 tools
Malware
Malware · 3ATT&CK
WarzoneRATS0670 ↗
Raccoon StealerS1148 ↗
BlackCatS1068 ↗
Tools
Tools · 6ATT&CK
RcloneS1040 ↗
LaZagneS0349 ↗
TorS0183 ↗
MimikatzS0002 ↗
ngrokS0508 ↗
ConnectWiseS0591 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs cited sources tie to Scattered Spider

none on KEV
  1. CVE-2015-22912026-10-17
    1. “Scattered Spider has deployed a malicious kernel driver through exploitation of CVE-2015-2291 in the Intel Ethernet diagnostics driver for Windows (iqvw64.sys).”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

    2. “the CrowdStrike Falcon ® platform prevented a novel attempt by SCATTERED SPIDER to deploy a malicious kernel driver through a vulnerability (CVE-2015-2291) in the Intel Ethernet diagnostics driver.”

      cited as exploiting · source: crowdstrike.com ↗ · 2026-10-17

  2. CVE-2021-354642026-10-17
    1. “During C0027 , Scattered Spider exploited CVE-2021-35464 in the ForgeRock Open Access Management (OpenAM) application server to gain initial access.”

      cited as used in a campaign · source: attack.mitre.org ↗ · 2026-10-17

    2. “Scattered Spider Group exploited CVE-2021-35464 to compromise a ForgeRock OpenAM application server.”

      cited as exploiting · source: picussecurity.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

11 sources
  1. 1.cybersecurity-insiders.com/scattered-spider-managed-mgm-resort-network-outage-bri…
  2. 2.loginradius.com/blog/identity/oktapus-phishing-targets-okta-identity-c…
  3. 3.attackiq.com/2023/11/21/attack-graph-response-to-cisa-advisory-aa23…
  4. 4.mandiant.com/resources/blog/unc3944-sms-phishing-sim-swapping-ranso…
  5. 5.attack.mitre.org/groups/G1015
  6. 6.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
  7. 7.crowdstrike.com/blog/scattered-spider-attempts-to-avoid-detection-with…
  8. 8.crowdstrike.com/adversaries/scattered-spider
  9. 9.cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from…
  10. 10.cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hard…
  11. +1 more in the JSON record

Track Scattered Spider on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.