Scattered Spider
Scattered Spider is identified in the provided content as a sophisticated threat actor, also known as UNC3944, Star Fraud, Octo Tempest, Scatter Swine, and Muddled Libra; one mention context also associates it with 0ktapus. The group is described as specializing in identity hijacking and social engineering, including helpdesk-focused social engineering, voice- and SMS-based phishing, and campaigns that exfiltrate data from common SaaS applications. Prosecutorial reporting cited in the content alleges members were involved in SIM-swapping activity via a Telegram channel called Star Chat beginning in 2022, using phishing to steal credentials from employees at major wireless providers in the U.S. and U.K. The content states that Scattered Spider has targeted technology, finance, and retail sectors, and another mention indicates campaigns against SaaS environments. The group is described as one of the most sophisticated and dangerous recent threat actors, with members believed to be teenagers and young adults primarily in the United States and the United Kingdom. No specific malware family, payload name, or technical indicators of compromise are provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Scattered Spider is a threat actor group specializing in social engineering, credential theft, and ransomware deployment (notably DragonForce). They use advanced phishing, SIM swapping, and living-off-the-land tactics, targeting technology, finance, and retail sectors.
Scattered Spider is a threat actor group known for data exfiltration campaigns, particularly targeting SaaS applications, and has expanded into enterprise environments with targeted, higher-cost methods.
Scattered Spider is a prolific cybercrime group known for SIM swapping, phishing, and ransomware attacks. They have targeted major organizations through social engineering, credential theft, and malware development, including custom rootkits and backdoors. The group is responsible for high-profile ransomware incidents, including attacks on MGM Resorts and Caesars Entertainment, and has extorted over $115 million in ransom payments.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.