# Scattered Spider (G1015): RMM-Based Persistence and Social-Engineering Intrusion Tradecraft

> Scattered Spider (MITRE ATT&CK G1015, aka UNC3944 / Octo Tempest / Roasted 0ktapus / Storm-0875 / Scatter Swine) is a native-English-speaking eCrime group active since at least May 2022 that bypasses MFA via convincing help-desk/IT impersonation and SIM-swap attacks, then persists using silently-installed legitimate RMM software (AnyDesk, TeamViewer, ScreenConnect, LogMeIn, VNC) alongside Mimikatz, ADExplorer, Chisel, and the Microsoft-signed POORTRY/STONESTOP EDR-killer driver toolkit. Scope has expanded from CRM/BPO/telecom/tech into gaming, hospitality, retail, MSP, manufacturing, and financial services, culminating in BlackCat/ALPHV and DragonForce ransomware deployment and cloud data theft.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1333
- **ID:** TL-2026-1333
- **Severity:** HIGH
- **Category:** THREAT_ACTOR
- **Status:** ACTIVE
- **Actor:** Scattered Spider
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2021-35464

## Description

Scattered Spider is a financially motivated, native-English-speaking cybercriminal collective tracked by MITRE ATT&CK as G1015 and across the industry as UNC3944, Octo Tempest, Roasted 0ktapus, Storm-0875, and Scatter Swine. Active since at least May 2022, the group's defining tradecraft is voice-based social engineering: operators call an organization's IT help desk or call an employee directly while impersonating IT/help-desk staff, using pretexting built from OSINT (LinkedIn, corporate directories, breach data) to sound convincing to native English speakers. The pretext is used to request password resets, new MFA device enrollment, or approval of a push/OTP prompt, effectively bypassing MFA without exploiting a technical flaw. Where impersonation alone does not succeed, the group escalates to MFA push-bombing (MFA fatigue, T1621) or SIM-swapping the victim's phone number to intercept SMS OTPs and voice calls.

Once initial access to an identity provider (commonly Okta) or VPN/remote-access portal is obtained, Scattered Spider registers rogue MFA devices, modifies conditional-access and identity federation policies, and creates new cloud roles/service principals for durable access (T1098, Account Manipulation). The group is notorious for large-scale phishing infrastructure supporting its social engineering: hundreds of registered lookalike domains following predictable naming patterns such as victimname-sso[.]com, victimname-servicedesk[.]com, victimname-okta[.]com, victimname-mfa[.]help, and (since Q1 2025) subdomain-based variants like sso.victimname[.]com to evade hyphenated-domain detections, frequently paired with the Evilginx adversary-in-the-middle phishing framework to relay live MFA challenges and steal session tokens.

Once inside, the group performs extensive discovery: enumerating privileged accounts and groups (T1069, T1087), mapping Active Directory with SysInternals ADExplorer, and mapping cloud tenancy (Azure AD/Entra ID, AWS, GCP) via native cloud APIs and console access (T1580). Credential harvesting relies heavily on Mimikatz and LaZagne for OS credential dumping (T1003, including NTDS.dit extraction and DCSync) and on Credentials from Password Stores (T1555.005) targeting password managers and browser vaults. For lateral movement and remote access the group installs legitimate commercial RMM tools -- AnyDesk, TeamViewer, ConnectWise ScreenConnect, LogMeIn, and TightVNC/VNC -- using silent/unattended installer switches so the software runs without a visible UI, blending into normal IT operations and evading detections keyed on file hashes rather than installation behavior. For network pivoting the group tunnels through firewalls with the open-source SOCKS/reverse-proxy utility Chisel, ngrok, and the Go-based Teleport agent, and has used Brute Ratel C4 and Cobalt Strike as post-exploitation C2 frameworks, alongside Impacket for SMB/WMI-based lateral movement.

A hallmark defense-evasion capability is the POORTRY/STONESTOP malicious driver toolkit, first observed deployed by UNC3944 as early as August 2022 and documented by Mandiant/Google Cloud TAG and Microsoft. STONESTOP is a Windows userland loader/orchestrator that installs and directs the POORTRY kernel-mode driver, which is used to terminate security and EDR processes with kernel privileges (Impair Defenses / T1562.001). Multiple POORTRY samples were legitimately code-signed via abused Microsoft Windows Hardware Compatibility Publisher (attestation-signing) certificates obtained by threat actors who compromised or purchased access to legitimate Microsoft Partner Center developer accounts; Microsoft suspended the abused partner accounts after a signing attempt was caught on 29 September 2022.

For data theft, the group exfiltrates over legitimate cloud storage and file-transfer services -- MEGA, Snowflake, AWS S3 -- (T1567.002, T1530) and pulls data from SharePoint and internal code repositories (T1213). Rclone is a commonly used exfiltration utility. Historically-documented campaigns include Campaign C0027 (June-December 2022) against telecom/BPO targets that exploited CVE-2021-35464 in ForgeRock OpenAM for initial access alongside extensive Azure/AWS reconnaissance, and the 2022 '0ktapus' phishing wave (tracked by Group-IB) that harvested credentials from 130+ organizations via SMS phishing of Okta identity pages. The group has since matured into a full ransomware affiliate, deploying BlackCat/ALPHV and DragonForce ransomware for extortion (T1486) and pursuing direct financial theft from cryptocurrency and financial-services victims (T1657). CISA/FBI first issued joint advisory AA23-320A on 16 November 2023 and released an updated version on 29 July 2025 reflecting continued evolution of TTPs, including expanded use of living-off-the-land (LOTL) techniques and allowlisted applications to evade detection, and frequent TTP rotation to stay ahead of defenses.

This case study emphasizes behavioral, not IOC-based, detection: because domains, hashes, and infrastructure churn quickly, the recommended hunting approach searches for command-line evidence of silent/unattended RMM installers (e.g., an AnyDesk installer invoked with silent-install and 'start with Windows' flags) rather than static indicators, and requires investigating deployment scope -- isolated silent RMM installs on a single endpoint warrant escalation, while widespread patterns may reflect legitimate IT deployment tooling.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1566.004 Spearphishing Voice
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1199 Trusted Relationship
- T1059.001 PowerShell
- T1098 Account Manipulation
- T1133 External Remote Services
- T1098.003 Additional Cloud Roles
- T1078 Valid Accounts
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1219.002 Remote Desktop Software
- T1112 Modify Registry
- T1553.002 Code Signing
- T1003 OS Credential Dumping
- T1621 Multi-Factor Authentication Request Generation
- T1555.005 Password Managers
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1087 Account Discovery
- T1069 Permission Groups Discovery
- T1580 Cloud Infrastructure Discovery
- T1083 File and Directory Discovery
- T1021.007 Cloud Services
- T1021.002 SMB/Windows Admin Shares
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1572 Protocol Tunneling
- T1090 Proxy
- T1219 Remote Access Tools
- T1567.002 Exfiltration to Cloud Storage
- T1486 Data Encrypted for Impact
- T1657 Financial Theft

## Sources

- [Threat Hunting Case Study: Scattered Spider](https://www.intel471.com/blog/threat-hunting-case-study-scattered-spider)
- [Scattered Spider (G1015) - MITRE ATT&CK](https://attack.mitre.org/groups/G1015/)
- [#StopRansomware: Scattered Spider (AA23-320A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a)
- [CISA and Partners Release Updated Advisory on Scattered Spider Group](https://www.cisa.gov/news-events/alerts/2025/07/29/cisa-and-partners-release-updated-advisory-scattered-spider-group)
- [Scattered Spider (AA23-320A) updated advisory PDF](https://www.cisa.gov/sites/default/files/2025-08/aa23-320a-scattered-spider-508c.pdf)
- [I Solemnly Swear My Driver Is Up to No Good: Hunting for Attestation Signed Malware](https://cloud.google.com/blog/topics/threat-intelligence/hunting-attestation-signed-malware)
- [Driving Through Defenses: Targeted Attacks Leverage Signed Malicious Microsoft Drivers](https://www.sentinelone.com/labs/driving-through-defenses-targeted-attacks-leverage-signed-malicious-microsoft-drivers/)
- [Microsoft-signed malicious Windows drivers used in ransomware attacks](https://www.bleepingcomputer.com/news/microsoft/microsoft-signed-malicious-windows-drivers-used-in-ransomware-attacks/)
- [Understanding an 0ktapus Phishing Campaign](https://www.fireblocks.com/blog/understanding-an-0ktapus-phishing-campaign)
- [Investigating 0ktapus: Phishing Analysis & Detection](https://www.wiz.io/blog/unmasking-phishing-strategies-for-identifying-0ktapus-domains)
- [Scattered Spider's Pre-Attack Infrastructure Exposed: 500+ Phishing Domains Mimic Enterprise Logins](https://informationsecuritybuzz.com/scattered-spiders-pre-attack-infrastructure-exposed-500-phishing-domains-mimic-enterprise-logins/)
- [Scattered Spider Targets Tech Companies for Help-Desk Exploitation](https://reliaquest.com/blog/scattered-spider-cyber-attacks-using-phishing-social-engineering-2025/)
- [Cross-Sector Mitigations: Scattered Spider](https://www.fsisac.com/hubfs/Scattered%20Spider/SectorThreatActorAnalysis-ScatteredSpider.pdf?hsLang=en)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1333