Scattered Spider (G1015): RMM-Based Persistence and Social-Engineering Intrusion Tradecraft
Scattered Spider (G1015) (TL-2026-1333), also tracked as Operation 0ktapus, is a high-severity tracked threat-actor profile, first published 2026-07-14. It is attributed to Scattered Spider with high confidence, affects ForgeRock OpenAM, references 1 CVE (CVE-2021-35464), maps to 33 MITRE ATT&CK techniques (T1003, T1021.002, T1021.007), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-1333
- Threat ID
- TL-2026-1333
- Also known as
- Operation 0ktapus
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_ACTOR
- First published
- 2026-07-14
- Last reviewed
- 2026-07-14
- Attribution
- Scattered Spider
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- telecoms, technology, businessprocessoutsourcing, gaming, hospitality, retail, managedserviceproviders, manufacturing, financialservices, insurance, aviation
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in Scattered Spider (G1015)
Malware and tooling: Ave Maria, BlackCat/ALPHV, DragonForce, POORTRY, Raccoon Stealer - S1148, STONESTOP, ADExplorer, AnyDesk, Brute Ratel C4 - S1063, Chisel, ConnectWise ScreenConnect, Evilginx
Scattered Spider (MITRE ATT&CK G1015, aka UNC3944 / Octo Tempest / Roasted 0ktapus / Storm-0875 / Scatter Swine) is a native-English-speaking eCrime group active since at least May 2022 that bypasses MFA via convincing help-desk/IT impersonation and SIM-swap attacks, then persists using silently-installed legitimate RMM software (AnyDesk, TeamViewer, ScreenConnect, LogMeIn, VNC) alongside Mimikatz, ADExplorer, Chisel, and the Microsoft-signed POORTRY/STONESTOP EDR-killer driver toolkit. Scope has expanded from CRM/BPO/telecom/tech into gaming, hospitality, retail, MSP, manufacturing, and financial services, culminating in BlackCat/ALPHV and DragonForce ransomware deployment and cloud data theft.
How Scattered Spider (G1015) works
Scattered Spider is a financially motivated, native-English-speaking cybercriminal collective tracked by MITRE ATT&CK as G1015 and across the industry as UNC3944, Octo Tempest, Roasted 0ktapus, Storm-0875, and Scatter Swine. Active since at least May 2022, the group's defining tradecraft is voice-based social engineering: operators call an organization's IT help desk or call an employee directly while impersonating IT/help-desk staff, using pretexting built from OSINT (LinkedIn, corporate directories, breach data) to sound convincing to native English speakers. The pretext is used to request password resets, new MFA device enrollment, or approval of a push/OTP prompt, effectively bypassing MFA without exploiting a technical flaw. Where impersonation alone does not succeed, the group escalates to MFA push-bombing (MFA fatigue, T1621) or SIM-swapping the victim's phone number to intercept SMS OTPs and voice calls.
Once initial access to an identity provider (commonly Okta) or VPN/remote-access portal is obtained, Scattered Spider registers rogue MFA devices, modifies conditional-access and identity federation policies, and creates new cloud roles/service principals for durable access (T1098, Account Manipulation). The group is notorious for large-scale phishing infrastructure supporting its social engineering: hundreds of registered lookalike domains following predictable naming patterns such as victimname-sso[.]com, victimname-servicedesk[.]com, victimname-okta[.]com, victimname-mfa[.]help, and (since Q1 2025) subdomain-based variants like sso.victimname[.]com to evade hyphenated-domain detections, frequently paired with the Evilginx adversary-in-the-middle phishing framework to relay live MFA challenges and steal session tokens.
Once inside, the group performs extensive discovery: enumerating privileged accounts and groups (T1069, T1087), mapping Active Directory with SysInternals ADExplorer, and mapping cloud tenancy (Azure AD/Entra ID, AWS, GCP) via native cloud APIs and console access (T1580). Credential harvesting relies heavily on Mimikatz and LaZagne for OS credential dumping (T1003, including NTDS.dit extraction and DCSync) and on Credentials from Password Stores (T1555.005) targeting password managers and browser vaults. For lateral movement and remote access the group installs legitimate commercial RMM tools -- AnyDesk, TeamViewer, ConnectWise ScreenConnect, LogMeIn, and TightVNC/VNC -- using silent/unattended installer switches so the software runs without a visible UI, blending into normal IT operations and evading detections keyed on file hashes rather than installation behavior. For network pivoting the group tunnels through firewalls with the open-source SOCKS/reverse-proxy utility Chisel, ngrok, and the Go-based Teleport agent, and has used Brute Ratel C4 and Cobalt Strike as post-exploitation C2 frameworks, alongside Impacket for SMB/WMI-based lateral movement.
A hallmark defense-evasion capability is the POORTRY/STONESTOP malicious driver toolkit, first observed deployed by UNC3944 as early as August 2022 and documented by Mandiant/Google Cloud TAG and Microsoft. STONESTOP is a Windows userland loader/orchestrator that installs and directs the POORTRY kernel-mode driver, which is used to terminate security and EDR processes with kernel privileges (Impair Defenses / T1562.001). Multiple POORTRY samples were legitimately code-signed via abused Microsoft Windows Hardware Compatibility Publisher (attestation-signing) certificates obtained by threat actors who compromised or purchased access to legitimate Microsoft Partner Center developer accounts; Microsoft suspended the abused partner accounts after a signing attempt was caught on 29 September 2022.
For data theft, the group exfiltrates over legitimate cloud storage and file-transfer services -- MEGA, Snowflake, AWS S3 -- (T1567.002, T1530) and pulls data from SharePoint and internal code repositories (T1213). Rclone is a commonly used exfiltration utility. Historically-documented campaigns include Campaign C0027 (June-December 2022) against telecom/BPO targets that exploited CVE-2021-35464 in ForgeRock OpenAM for initial access alongside extensive Azure/AWS reconnaissance, and the 2022 '0ktapus' phishing wave (tracked by Group-IB) that harvested credentials from 130+ organizations via SMS phishing of Okta identity pages. The group has since matured into a full ransomware affiliate, deploying BlackCat/ALPHV and DragonForce ransomware for extortion (T1486) and pursuing direct financial theft from cryptocurrency and financial-services victims (T1657). CISA/FBI first issued joint advisory AA23-320A on 16 November 2023 and released an updated version on 29 July 2025 reflecting continued evolution of TTPs, including expanded use of living-off-the-land (LOTL) techniques and allowlisted applications to evade detection, and frequent TTP rotation to stay ahead of defenses.
This case study emphasizes behavioral, not IOC-based, detection: because domains, hashes, and infrastructure churn quickly, the recommended hunting approach searches for command-line evidence of silent/unattended RMM installers (e.g., an AnyDesk installer invoked with silent-install and 'start with Windows' flags) rather than static indicators, and requires investigating deployment scope -- isolated silent RMM installs on a single endpoint warrant escalation, while widespread patterns may reflect legitimate IT deployment tooling.
MITRE ATT&CK techniques used in TL-2026-1333
Credential Access
T1003 OS Credential Dumping; T1539 Steal Web Session Cookie; T1555.005 Password Managers; T1557 Adversary-in-the-Middle; T1621 Multi-Factor Authentication Request Generation
Lateral Movement
T1021.002 SMB/Windows Admin Shares; T1021.007 Cloud Services
Defense Evasion
Execution
Discovery
T1069 Permission Groups Discovery; T1083 File and Directory Discovery; T1087 Account Discovery; T1580 Cloud Infrastructure Discovery
Privilege Escalation
T1078 Valid Accounts; T1098.003 Additional Cloud Roles
Command and Control
T1090 Proxy; T1219 Remote Access Tools; T1572 Protocol Tunneling
Persistence
T1098 Account Manipulation; T1133 External Remote Services
defense-impairment
T1112 Modify Registry; T1553.002 Code Signing; T1685 Disable or Modify Tools
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship; T1566.004 Spearphishing Voice
Collection
T1213 Data from Information Repositories; T1530 Data from Cloud Storage
command-and-control
T1219.002 Remote Desktop Software
Impact
T1486 Data Encrypted for Impact; T1657 Financial Theft
Exfiltration
T1567.002 Exfiltration to Cloud Storage
Reconnaissance
Affected products and versions in Scattered Spider (G1015)
- ForgeRock — OpenAM
Vulnerable versions: prior to fixed version, exploited in Campaign C0027
Fixed in: patched release addressing CVE-2021-35464 - Multi-vendor — RMM software (AnyDesk, TeamViewer, ConnectWise ScreenConnect, LogMeIn, TightVNC/VNC)
Vulnerable versions: all versions when silently installed by an attacker with valid/social-engineered access - Microsoft — Windows Hardware Compatibility Publisher driver signing / Partner Center
Vulnerable versions: signing process abused prior to account suspension (October 2022)
Fixed in: abused partner accounts suspended by Microsoft, October 2022
Remediation for Scattered Spider (G1015)
Immediate actions
- Hunt for command-line evidence of silent/unattended RMM installers (e.g. AnyDesk, TeamViewer, ScreenConnect, LogMeIn, VNC) combined with 'silent install' and 'start with Windows' flags on endpoints
- Enforce out-of-band, callback-based identity verification for any help-desk password reset or MFA re-enrollment request
- Block or tightly allowlist installation and execution of unauthorized RMM software via application control (WDAC/AppLocker)
- Revoke and re-issue MFA devices/tokens for any account subject to a suspicious reset or push-approval event
- Hunt for Chisel, ngrok, Teleport agent, and Rclone binaries and associated outbound tunneling traffic
Workarounds
- Require in-person or video-verified identity confirmation for help-desk credential and MFA resets
- Disable self-service MFA device enrollment for high-privilege accounts
Longer-term hardening
- Deploy EDR/XDR with behavioral detection for LOTL and silent-install patterns rather than static hash/IOC matching
- Move to phishing-resistant MFA (FIDO2/WebAuthn hardware keys) for privileged and help-desk-facing accounts
- Implement number-matching / context-rich MFA push approvals to blunt MFA-fatigue attacks
- Deploy Windows driver blocklist / HVCI policies to prevent loading of abused Microsoft-signed malicious drivers such as POORTRY
- Restrict and monitor privileged Active Directory and cloud IAM role/service-principal creation
- Register and monitor for lookalike domains matching victimname-sso/-okta/-servicedesk/-mfa naming patterns
CVEs associated with Scattered Spider (G1015)
CVE-2021-35464
Weaknesses (CWE) in Scattered Spider (G1015)
CWE-287, CWE-295, CWE-494
Timeline of Scattered Spider (G1015)
- Scattered Spider (UNC3944 / G1015) activity first tracked, initially targeting CRM providers, BPO firms, telecommunications and technology companies.
- Campaign C0027 (June-December 2022) targets telecom/BPO sector, exploiting CVE-2021-35464 in ForgeRock OpenAM and performing extensive Azure/AWS reconnaissance.
- UNC3944 observed deploying the STONESTOP userland loader alongside the POORTRY kernel-mode EDR-killer driver.
- 0ktapus phishing campaign identified by Group-IB: large-scale SMS phishing of Okta identity pages harvests credentials from 130+ organizations worldwide.
- Microsoft detects a new attempt to submit a malicious POORTRY driver for Windows Hardware Compatibility Publisher (attestation) signing via a compromised/abused Partner Center developer account.
- Microsoft suspends the abused Partner Center developer/seller accounts used to obtain fraudulent driver signatures for POORTRY.
- Mandiant/Google Cloud TAG and SentinelOne publicly disclose the POORTRY/STONESTOP Microsoft-signed malicious driver toolkit and its use by multiple ransomware-affiliated actors including UNC3944.
- Group expands targeting scope beyond telecom/BPO into gaming, hospitality, retail, MSP, manufacturing, and financial services sectors.
- CISA and FBI issue joint Cybersecurity Advisory AA23-320A detailing Scattered Spider TTPs, IOCs, and mitigations.
- Group shifts phishing domain conventions from hyphenated patterns (victim-sso.com) to subdomain-based patterns (sso.victim.com) to evade automated impersonation detection.
- Security researchers publicly expose 500+ Scattered Spider phishing domains mimicking enterprise SSO/help-desk login portals.
- CISA, FBI, and international partners release an updated version of advisory AA23-320A reflecting continued TTP evolution, including deeper LOTL technique usage.
- Intel471 publishes a threat-hunting case study on Scattered Spider RMM-abuse and help-desk impersonation tradecraft, recommending behavioral (command-line pattern) detection over static IOC matching.
Sources cited for Scattered Spider (G1015)
- Threat Hunting Case Study: Scattered Spider
- Scattered Spider (G1015) - MITRE ATT&CK
- #StopRansomware: Scattered Spider (AA23-320A)
- CISA and Partners Release Updated Advisory on Scattered Spider Group
- Scattered Spider (AA23-320A) updated advisory PDF
- I Solemnly Swear My Driver Is Up to No Good: Hunting for Attestation Signed Malware
- Driving Through Defenses: Targeted Attacks Leverage Signed Malicious Microsoft Drivers
- Microsoft-signed malicious Windows drivers used in ransomware attacks
- Understanding an 0ktapus Phishing Campaign
- Investigating 0ktapus: Phishing Analysis & Detection
- Scattered Spider's Pre-Attack Infrastructure Exposed: 500+ Phishing Domains Mimic Enterprise Logins
- Scattered Spider Targets Tech Companies for Help-Desk Exploitation
- Cross-Sector Mitigations: Scattered Spider
Threats related to Scattered Spider (G1015)
Detection coverage for TL-2026-1333
As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1333 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.