Activity timeline
Scattered Spider appears in 15 tracked threats between and ; the busiest month was 2026-02 with 7 reports.
ATT&CK techniques observed
- T1078 Valid Accounts — Initial Accessobserved in 13 of 15 tracked threats
- T1621 Multi-Factor Authentication Request Generation — Credential Accessobserved in 13 of 15 tracked threats
- T1657 Financial Theft — Impactobserved in 13 of 15 tracked threats
- T1199 Trusted Relationship — Initial Accessobserved in 9 of 15 tracked threats
- T1213 Data from Information Repositories — Collectionobserved in 9 of 15 tracked threats
- T1486 Data Encrypted for Impact — Impactobserved in 9 of 15 tracked threats
- T1530 Data from Cloud Storage — Collectionobserved in 9 of 15 tracked threats
- T1589 Gather Victim Identity Information — Reconnaissanceobserved in 9 of 15 tracked threats
- T1098 Account Manipulation — Persistenceobserved in 8 of 15 tracked threats
- T1204 User Execution — Executionobserved in 8 of 15 tracked threats
- T1528 Steal Application Access Token — Credential Accessobserved in 8 of 15 tracked threats
- T1566 Phishing — Initial Accessobserved in 8 of 15 tracked threats
- T1566.004 Spearphishing Voice — Initial Accessobserved in 8 of 15 tracked threats
- T1567 Exfiltration Over Web Service — Exfiltrationobserved in 8 of 15 tracked threats
- T1087 Account Discovery — Discoveryobserved in 7 of 15 tracked threats
Tracked threats
- Scattered Spider (UNC3944 / Octo Tempest) Help Desk Social Engineering to Bypass MFAHIGH
- Ransomware Actors Escalate to Personal Intimidation and Physical Threats Against Victim Staff (Semperis 2026 Ransomware Risk Report)MEDIUM
- Unit 42: Identity Compromise Is the Primary Attack Vector in Nearly 90% of IncidentsHIGH
- DragonForce Ransomware: Vishing-Driven Help Desk Social Engineering Against UK Retailers (M&S, Co-op, Harrods)HIGH
- Two Scattered Spider Leaders Jailed for £29M Transport for London (TfL) CyberattackHIGH
- Check Point 2026 AI Security Report: Autonomous AI-Driven Exploitation, CLAUDE.md Jailbreaking, and Generative Identity Fraud Fuel Scattered Spider / ShinyHunters CampaignsHIGH
- Scattered Spider (G1015): RMM-Based Persistence and Social-Engineering Intrusion TradecraftHIGH
- Infinite Campus Salesforce Breach by ShinyHunters / UNC6040 — 137,100 K-12 School Staff Accounts Exfiltrated and ExtortedHIGH
- BYOVD EDR Killer Tooling — Ransomware Groups Weaponizing Signed Kernel Drivers to Blind Endpoint DetectionHIGH
- ShinyHunters Leaks 5.1 Million Panera Bread Customer RecordsHIGH
- ShinyHunters Evolves TTPs: Vishing and Login Harvesting for SSO/MFA BypassHIGH
- ShinyHunters-Branded Extortion Campaign Expands with Vishing & SSO AttacksHIGH
- SLSH Extortion Group - Swatting and Executive Harassment TacticsHIGH
- ShinyHunters Extortion Campaign - Evolved Vishing and SSO Credential TheftHIGH
- ShinyHunters SSO Vishing Campaign - Cloud Data Theft via Social EngineeringCRITICAL