# Scattered Spider (UNC3944 / Octo Tempest) Help Desk Social Engineering to Bypass MFA

> Scattered Spider (UNC3944, Octo Tempest) phones IT help desks while posing as employees who lost a phone or MFA device, to obtain password and MFA resets and take over accounts. Account takeover gives access to email, SSO, VPN and cloud services, followed by data theft for extortion and, more recently, DragonForce ransomware on VMware ESXi.

- **Published:** 2026-10-24T03:21:54Z
- **Last reviewed:** 2026-10-24T03:21:54Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4337
- **ID:** TL-2026-4337
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Scattered Spider
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Scattered Spider is a financially motivated, English-speaking, identity-focused intrusion group tracked by Mandiant as UNC3944 and by Microsoft as Octo Tempest. Other vendors use the aliases Oktapus, Storm-0875 and Muddled Libra. A 2026-10-21 Cyber Security News article summarises the group's help desk vishing playbook. It also cautions that help desk vishing on its own does not prove Scattered Spider carried out an incident. The article lists no hashes or network indicators.

Initial access is overwhelmingly social engineering. Operators research staff using professional profiles and breached or purchased data, then phone or message IT staff and impersonate an employee who needs account recovery. The goal is a password reset or registration of an attacker-controlled MFA device. Related methods in the CISA/FBI advisory AA23-320A and Mandiant reporting include SMS phishing (smishing), MFA fatigue (repeated push prompts), SIM swapping, fake SSO and help desk look-alike domains (for example the pattern targetname-sso, targetname-servicedesk, targetname-okta), and impersonation of IT staff over Microsoft Teams. CISA notes the use of publicly available and stolen data to pass identity verification.

After account takeover the actors reach SSO portals, VPN, email and cloud services. They register further MFA methods, create accounts, and abuse federated identity trust (T1484.002). They enumerate Active Directory with ADRecon, ADExplorer and SharpHound, and browse SharePoint, code repositories and cloud storage. Persistence and remote control rely heavily on legitimate remote access tools (AnyDesk, ScreenConnect, Splashtop, TeamViewer, Tailscale, Ngrok, Pulseway, Level.io, Fleetdeck, Tactical.RMM, Teleport) and on the RattyRAT Java RAT. CISA also lists the AveMaria/WarZone RAT and the Raccoon and Vidar stealers, and Mimikatz for credentials. Data is exfiltrated to MEGA.NZ, Amazon S3 and similar cloud storage.

The group moved from SIM-swap operations against telecoms to data theft and extortion in early 2023. It has since used RaaS affiliations including ALPHV/BlackCat and RansomHub. Mandiant and the July 2025 AA23-320A update report DragonForce ransomware used against VMware ESXi hosts, linked to a UK retail incident in May 2025. Mandiant reported seeing no new intrusions directly attributable to UNC3944 after arrests in July 2025. Because the tradecraft is widely shared across The Com ecosystem, similar help desk vishing may come from other actors.

Defensive priorities are phishing-resistant MFA (FIDO2/WebAuthn), positive identity verification before any password or MFA change, out-of-band callback verification, alerting on new MFA device registration (especially one device registered to several users), restricting MFA registration to trusted locations, monitoring federation changes, isolating ESXi/vCenter and backups from the central IdP, and keeping immutable offline backups.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1598.004 Phishing for Information: Spearphishing Voice
- T1583.001 Acquire Infrastructure: Domains
- T1566.004 Phishing: Spearphishing Voice
- T1078 Valid Accounts
- T1204 User Execution
- T1556.006 Modify Authentication Process: Multi-Factor Authentication
- T1136 Create Account
- T1484.002 Domain or Tenant Policy Modification: Trust Modification
- T1684.001 Impersonation
- T1621 Multi-Factor Authentication Request Generation
- T1451 SIM Card Swap
- T1552.001 Unsecured Credentials: Credentials In Files
- T1018 Remote System Discovery
- T1021.007 Remote Services: Cloud Services
- T1213.002 Data from Information Repositories: Sharepoint
- T1530 Data from Cloud Storage
- T1219 Remote Access Tools
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

## Sources

- [Scattered Spider Hackers Exploit Help Desk Calls to Bypass MFA and Breach Corporate Networks](https://cybersecuritynews.com/scattered-spider-hackers/)
- [CISA/FBI Advisory AA23-320A: Scattered Spider](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a)
- [CISA and Partners Release Updated Advisory on Scattered Spider Group](https://www.cisa.gov/news-events/alerts/2025/07/29/cisa-and-partners-release-updated-advisory-scattered-spider-group)
- [FBI IC3 Joint Advisory PDF (July 2025 update)](https://www.ic3.gov/CSA/2025/250729.pdf)
- [Google Cloud / Mandiant: UNC3944 Proactive Hardening Recommendations](https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations)
- [Flare: The Com Ecosystem, Actors and Attribution (Jon DiMaggio)](https://flare.io/learn/resources/blog/the-com-ecosystem-actors-attribution)
- [Australian Cyber Security Centre: Scattered Spider](https://www.cyber.gov.au/advisory/scattered-spider)
- [The Hacker News: Scattered Spider hacker arrests halt activity](https://thehackernews.com/2025/07/scattered-spider-hacker-arrests-halt.html)
- [The Register: Ex-NSA bad-guy hunter listened to Scattered Spider's fake help-desk calls](https://www.theregister.com/2025/05/18/ex_nsa_scattered_spider_call/)
- [Cyble: Scattered Spider ransomware in 2025](https://cyble.com/blog/scattered-spider-ransomware-in-2025-cyber-alert/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4337