Threat reportAPTTL-2026-4337
Scattered Spider (UNC3944 / Octo Tempest) Help Desk Social Engineering to Bypass MFA
Scattered Spider (UNC3944 / Octo Tempest) Help Desk Social (TL-2026-4337), also tracked as Scattered Spider, is a high-severity advanced persistent threat campaign, first published 2026-10-24. It is attributed to Scattered Spider with medium confidence, affects Multiple Help desk and identity workflows (SSO, MFA enrollment, maps to 19 MITRE ATT&CK techniques (T1018, T1021.007, T1078), and is covered by 9 detection rules and 25 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 19MITRE ATT&CK
- Actors
- 1Scattered Spider
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 25Indicators of compromise
Key facts for TL-2026-4337
- Threat ID
- TL-2026-4337
- Also known as
- Scattered Spider, UNC3944, Octo Tempest
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- Scattered Spider
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- retail, telecoms, technology, finance, business-process-outsourcing, gaming, hospitality, news - media, commercial-facilities, food-services
- Target regions
- North America, united kingdom, australia, singapore, india
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in Scattered Spider (UNC3944 / Octo Tempest) Help Desk Social
Malware and tooling: ALPHV/BlackCat, AveMaria/WarZone, DragonForce, Raccoon Stealer - S1148, RansomHub - S1212, RattyRAT, VIDAR Stealer, ADExplorer, ADRecon, AnyDesk, FleetDeck.io, Level.io
How Scattered Spider (UNC3944 / Octo Tempest) Help Desk Social works
Scattered Spider (UNC3944, Octo Tempest) phones IT help desks while posing as employees who lost a phone or MFA device, to obtain password and MFA resets and take over accounts. Account takeover gives access to email, SSO, VPN and cloud services, followed by data theft for extortion and, more recently, DragonForce ransomware on VMware ESXi.
Scattered Spider is a financially motivated, English-speaking, identity-focused intrusion group tracked by Mandiant as UNC3944 and by Microsoft as Octo Tempest. Other vendors use the aliases Oktapus, Storm-0875 and Muddled Libra. A 2026-10-21 Cyber Security News article summarises the group's help desk vishing playbook. It also cautions that help desk vishing on its own does not prove Scattered Spider carried out an incident. The article lists no hashes or network indicators.
Initial access is overwhelmingly social engineering. Operators research staff using professional profiles and breached or purchased data, then phone or message IT staff and impersonate an employee who needs account recovery. The goal is a password reset or registration of an attacker-controlled MFA device. Related methods in the CISA/FBI advisory AA23-320A and Mandiant reporting include SMS phishing (smishing), MFA fatigue (repeated push prompts), SIM swapping, fake SSO and help desk look-alike domains (for example the pattern targetname-sso, targetname-servicedesk, targetname-okta), and impersonation of IT staff over Microsoft Teams. CISA notes the use of publicly available and stolen data to pass identity verification.
After account takeover the actors reach SSO portals, VPN, email and cloud services. They register further MFA methods, create accounts, and abuse federated identity trust (T1484.002). They enumerate Active Directory with ADRecon, ADExplorer and SharpHound, and browse SharePoint, code repositories and cloud storage. Persistence and remote control rely heavily on legitimate remote access tools (AnyDesk, ScreenConnect, Splashtop, TeamViewer, Tailscale, Ngrok, Pulseway, Level.io, Fleetdeck, Tactical.RMM, Teleport) and on the RattyRAT Java RAT. CISA also lists the AveMaria/WarZone RAT and the Raccoon and Vidar stealers, and Mimikatz for credentials. Data is exfiltrated to MEGA.NZ, Amazon S3 and similar cloud storage.
The group moved from SIM-swap operations against telecoms to data theft and extortion in early 2023. It has since used RaaS affiliations including ALPHV/BlackCat and RansomHub. Mandiant and the July 2025 AA23-320A update report DragonForce ransomware used against VMware ESXi hosts, linked to a UK retail incident in May 2025. Mandiant reported seeing no new intrusions directly attributable to UNC3944 after arrests in July 2025. Because the tradecraft is widely shared across The Com ecosystem, similar help desk vishing may come from other actors.
Defensive priorities are phishing-resistant MFA (FIDO2/WebAuthn), positive identity verification before any password or MFA change, out-of-band callback verification, alerting on new MFA device registration (especially one device registered to several users), restricting MFA registration to trusted locations, monitoring federation changes, isolating ESXi/vCenter and backups from the central IdP, and keeping immutable offline backups.
MITRE ATT&CK techniques used in TL-2026-4337
Discovery
Lateral Movement
T1021.007 Remote Services: Cloud Services
Initial Access
T1078 Valid Accounts; T1566.004 Phishing: Spearphishing Voice
Persistence
T1136 Create Account; T1556.006 Modify Authentication Process: Multi-Factor Authentication
Execution
Collection
T1213.002 Data from Information Repositories: Sharepoint; T1530 Data from Cloud Storage
Command and Control
initial-access
Privilege Escalation
T1484.002 Domain or Tenant Policy Modification: Trust Modification
Credential Access
T1552.001 Unsecured Credentials: Credentials In Files; T1621 Multi-Factor Authentication Request Generation
Exfiltration
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
Resource Development
T1583.001 Acquire Infrastructure: Domains
Reconnaissance
T1589 Gather Victim Identity Information; T1598.004 Phishing for Information: Spearphishing Voice
Defense Evasion
Affected products and versions in Scattered Spider (UNC3944 / Octo Tempest) Help Desk Social
- Multiple — Help desk and identity workflows (SSO, MFA enrollment, self-service password reset)
Vulnerable versions: Organizations without positive identity verification for credential and MFA resets - VMware — ESXi (DragonForce ransomware encryption target)
Vulnerable versions: Hosts with admin auth bound to the central IdP
Remediation for Scattered Spider (UNC3944 / Octo Tempest) Help Desk Social
Immediate actions
- Require positive identity verification (on-camera or out-of-band callback to a registered contact) before any password or MFA reset, especially for privileged accounts
- Alert on new MFA device registrations and on one MFA device registered to multiple users
- Restrict MFA registration to trusted IPs and compliant devices
- Disable or tighten self-service password reset during elevated threat periods
- Block unapproved remote access tools (AnyDesk, ScreenConnect, Splashtop, TeamViewer, Ngrok, Tailscale and similar) and monitor for look-alike SSO/help desk domains
Workarounds
- Remove SMS, voice and email as sole authentication factors
- Restrict external Teams/collaboration contact to a trusted domain allowlist
Longer-term hardening
- Deploy phishing-resistant MFA (FIDO2/WebAuthn or PKI) for all users, mandatory for administrators
- Isolate ESXi, vCenter, PAM and backup systems from the central identity provider and keep immutable offline backups
- Monitor Entra ID federation and domain changes and external Teams contact from unknown tenants
- Train help desk staff on urgency-based pretexts and run vishing simulations
Weaknesses (CWE) in Scattered Spider (UNC3944 / Octo Tempest) Help Desk Social
Timeline of Scattered Spider (UNC3944 / Octo Tempest) Help Desk Social
- CISA and FBI publish joint advisory AA23-320A on Scattered Spider TTPs.
- AA23-320A updated with a password recommendation change.
- RansomHub, a RaaS used by UNC3944 as an affiliate in 2024, ceases operations and DragonForce operators claim control (month-level date per Mandiant).
- Public reporting links a UK retail incident with DragonForce ransomware to tactics consistent with Scattered Spider (month-level date).
- The Register reports on analysis of Scattered Spider's fake help desk calls.
- CISA, FBI and partners publish a major AA23-320A update with TTPs from FBI investigations through June 2025, including DragonForce ESXi encryption.
- Cyber Security News article on Scattered Spider help desk vishing to bypass MFA, naming RattyRAT and DragonForce.
Sources cited for Scattered Spider (UNC3944 / Octo Tempest) Help Desk Social
- Scattered Spider Hackers Exploit Help Desk Calls to Bypass MFA and Breach Corporate Networks
- CISA/FBI Advisory AA23-320A: Scattered Spider
- CISA and Partners Release Updated Advisory on Scattered Spider Group
- FBI IC3 Joint Advisory PDF (July 2025 update)
- Google Cloud / Mandiant: UNC3944 Proactive Hardening Recommendations
- Flare: The Com Ecosystem, Actors and Attribution (Jon DiMaggio)
- Australian Cyber Security Centre: Scattered Spider
- The Hacker News: Scattered Spider hacker arrests halt activity
- The Register: Ex-NSA bad-guy hunter listened to Scattered Spider's fake help-desk calls
- Cyble: Scattered Spider ransomware in 2025
Detection coverage for TL-2026-4337
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4337 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.