# Scattered Spider

> As of 2026-10-21, Scattered Spider is a threat actor tracked by Threadlinqs Intelligence across 14 threats spanning ransomware, threat intel, threat actor. Also known as 0ktapus, ShinyHunters, LAPSUS, Lapsus$. ATT&CK coverage spans 142 techniques across 16 tactics in 14 of 14 tracked threats. Most-observed techniques: T1078 (Valid Accounts), T1621 (Multi-Factor Authentication Request Generation), T1657 (Financial Theft).

- **Tracked threats:** 14
- **Categories:** RANSOMWARE, THREAT_INTEL, THREAT_ACTOR, DATA_BREACH, MALWARE, CAMPAIGN
- **Also known as:** 0ktapus, ShinyHunters, LAPSUS, Lapsus$, Muddled Libra, DEV-0971, Octo Tempest, Oktapus, Roasted 0ktapus, Scatter Swine, Scattered Swine, Starfraud
- **As of:** 2026-10-21

## ATT&CK techniques observed

142 techniques observed across 14 of 14 tracked threats. Tactics: Credential Access (19), Stealth (formerly Defense Evasion) (17), Discovery (16), Persistence (16), Resource Development (12), Initial Access (11).

- [T1078](https://intel.threadlinqs.com/technique/T1078) Valid Accounts — Initial Access — observed in 12 of 14 tracked threats
- [T1621](https://intel.threadlinqs.com/technique/T1621) Multi-Factor Authentication Request Generation — Credential Access — observed in 12 of 14 tracked threats
- [T1657](https://intel.threadlinqs.com/technique/T1657) Financial Theft — Impact — observed in 12 of 14 tracked threats
- [T1199](https://intel.threadlinqs.com/technique/T1199) Trusted Relationship — Initial Access — observed in 9 of 14 tracked threats
- [T1213](https://intel.threadlinqs.com/technique/T1213) Data from Information Repositories — Collection — observed in 9 of 14 tracked threats
- [T1098](https://intel.threadlinqs.com/technique/T1098) Account Manipulation — Persistence — observed in 8 of 14 tracked threats
- [T1486](https://intel.threadlinqs.com/technique/T1486) Data Encrypted for Impact — Impact — observed in 8 of 14 tracked threats
- [T1528](https://intel.threadlinqs.com/technique/T1528) Steal Application Access Token — Credential Access — observed in 8 of 14 tracked threats
- [T1530](https://intel.threadlinqs.com/technique/T1530) Data from Cloud Storage — Collection — observed in 8 of 14 tracked threats
- [T1566](https://intel.threadlinqs.com/technique/T1566) Phishing — Initial Access — observed in 8 of 14 tracked threats
- [T1567](https://intel.threadlinqs.com/technique/T1567) Exfiltration Over Web Service — Exfiltration — observed in 8 of 14 tracked threats
- [T1589](https://intel.threadlinqs.com/technique/T1589) Gather Victim Identity Information — Reconnaissance — observed in 8 of 14 tracked threats
- [T1204](https://intel.threadlinqs.com/technique/T1204) User Execution — Execution — observed in 7 of 14 tracked threats
- [T1552](https://intel.threadlinqs.com/technique/T1552) Unsecured Credentials — Credential Access — observed in 7 of 14 tracked threats
- [T1566.004](https://intel.threadlinqs.com/technique/T1566.004) Spearphishing Voice — Initial Access — observed in 7 of 14 tracked threats

## Tracked threats

- [Ransomware Actors Escalate to Personal Intimidation and Physical Threats Against Victim Staff (Semperis 2026 Ransomware Risk Report)](https://intel.threadlinqs.com/threat/TL-2026-3467) — MEDIUM
- [Unit 42: Identity Compromise Is the Primary Attack Vector in Nearly 90% of Incidents](https://intel.threadlinqs.com/threat/TL-2026-1938) — HIGH
- [DragonForce Ransomware: Vishing-Driven Help Desk Social Engineering Against UK Retailers (M&S, Co-op, Harrods)](https://intel.threadlinqs.com/threat/TL-2026-1647) — HIGH
- [Two Scattered Spider Leaders Jailed for £29M Transport for London (TfL) Cyberattack](https://intel.threadlinqs.com/threat/TL-2026-1429) — HIGH
- [Check Point 2026 AI Security Report: Autonomous AI-Driven Exploitation, CLAUDE.md Jailbreaking, and Generative Identity Fraud Fuel Scattered Spider / ShinyHunters Campaigns](https://intel.threadlinqs.com/threat/TL-2026-1347) — HIGH
- [Scattered Spider (G1015): RMM-Based Persistence and Social-Engineering Intrusion Tradecraft](https://intel.threadlinqs.com/threat/TL-2026-1333) — HIGH
- [Infinite Campus Salesforce Breach by ShinyHunters / UNC6040 — 137,100 K-12 School Staff Accounts Exfiltrated and Extorted](https://intel.threadlinqs.com/threat/TL-2026-0804) — HIGH
- [BYOVD EDR Killer Tooling — Ransomware Groups Weaponizing Signed Kernel Drivers to Blind Endpoint Detection](https://intel.threadlinqs.com/threat/TL-2026-0091) — HIGH
- [ShinyHunters Leaks 5.1 Million Panera Bread Customer Records](https://intel.threadlinqs.com/threat/TL-2026-0055) — HIGH
- [ShinyHunters Evolves TTPs: Vishing and Login Harvesting for SSO/MFA Bypass](https://intel.threadlinqs.com/threat/TL-2026-0054) — HIGH
- [ShinyHunters-Branded Extortion Campaign Expands with Vishing & SSO Attacks](https://intel.threadlinqs.com/threat/TL-2026-0045) — HIGH
- [SLSH Extortion Group - Swatting and Executive Harassment Tactics](https://intel.threadlinqs.com/threat/TL-2026-0035) — HIGH
- [ShinyHunters Extortion Campaign - Evolved Vishing and SSO Credential Theft](https://intel.threadlinqs.com/threat/TL-2026-0030) — HIGH
- [ShinyHunters SSO Vishing Campaign - Cloud Data Theft via Social Engineering](https://intel.threadlinqs.com/threat/TL-2026-0013) — CRITICAL

## Related CVEs

4 CVEs referenced by tracked Scattered Spider activity.

- [CVE-2025-61882](https://intel.threadlinqs.com/cve/CVE-2025-61882)
- [CVE-2021-35464](https://intel.threadlinqs.com/cve/CVE-2021-35464)
- [CVE-2018-19320](https://intel.threadlinqs.com/cve/CVE-2018-19320)
- [CVE-2015-2291](https://intel.threadlinqs.com/cve/CVE-2015-2291)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/Scattered%20Spider