Scattered Spider

Also tracked as UNC3944, Octo Tempest, Muddled Libra, 0ktapus, Scatter Swine, Storm-0875, LUCR-3

Scattered Spider is a financially motivated group known for aggressive social engineering, help desk impersonation, and SIM swapping to breach large enterprises. In the cloud it abuses stolen identities and federation to take over AWS and Azure tenants. It then steals data and often deploys ransomware for extortion.

Cloud tradecraft

• Uses help desk vishing and MFA fatigue to take over cloud identities
• Registers attacker MFA tokens and devices to keep account access
• Adds a federated identity provider to the victim SSO tenant for persistence
• Creates temporary federated AWS credentials with aws_consoler to pivot to console
• Assigns itself high privilege IAM and Azure roles after access
• Exfiltrates data to attacker controlled S3 buckets and MEGA before extortion

MITRE ATT&CK techniques

References

• MITRE ATT&CK: Scattered Spider (G1015)
• FBI and CISA: #StopRansomware Scattered Spider (AA23-320A)
• Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction
• UNC3944 Targets SaaS Applications