Scattered Spider gets in by persuading people, usually the IT help desk, to hand over passwords and MFA, and then uses legitimate identity and remote access tools until it can steal data or deploy ransomware. This profile draws on MITRE ATT&CK, CISA and the FBI, the UK NCSC, Microsoft and Mandiant to cover the group's identity techniques, linked incidents and the controls that break its playbook. It is for identity, security operations and service desk leads; attribution follows each primary source's wording.
Key takeaways
- Identity is the attack surface. MITRE describes a group that impersonates IT and help desk staff to gain initial access, bypass MFA and reach administrator access in Okta, AWS and Office 365.
- The help desk reset is the critical control point. MITRE records help desk staff being compelled to reset passwords and MFA tokens (T1684.001), followed by the attacker registering its own MFA methods (T1556.006).
- Persistence lives in the identity plane. The group has added a federated identity provider to a victim's SSO tenant (T1484.002), added trusted locations to Conditional Access (T1556.009) and assigned cloud admin roles (T1098.003).
- Legitimate tools hide the intrusion. Remote management, tunnelling and cloud storage tools carry access and data out; CISA notes their use alone does not indicate compromise, so allowlisting matters.
- Defences are known and mostly procedural. Out-of-band identity verification at the help desk, phishing-resistant MFA, segregated admin identities and monitoring of authenticator and federation changes address most of the documented techniques.
Who they are (names and aliases)
MITRE ATT&CK tracks the group as G1015 and describes it as a native English-speaking cybercriminal group active since at least 2022. Different organisations use different names, and vendor clusters overlap rather than map one to one, so record which source a name comes from.
| Name | Source | How the source relates it to Scattered Spider |
|---|---|---|
| Scattered Spider (G1015) | MITRE ATT&CK | Primary name; MITRE lists Roasted 0ktapus, Octo Tempest, Storm-0875 and UNC3944 as associated names |
| Starfraud, UNC3944, Scatter Swine, Muddled Libra | CISA and FBI advisory AA23-320A | Listed by the advisory as other names for the group |
| Octo Tempest | Microsoft | A financially motivated collective of native English-speaking actors whose activity overlaps with research on 0ktapus, Scattered Spider and UNC3944 |
| UNC3944 | Mandiant (Google Cloud) | Overlaps with public reporting on Scattered Spider; characterised by persistent social engineering and brazen communication with victims |
| 0ktapus | Group-IB (reported by Help Net Security, August 2022) | A 2022 phishing campaign aimed at Okta credentials and one-time codes; MITRE's alias Roasted 0ktapus reflects the overlap |
Law enforcement: on 18 September 2025 the US Department of Justice announced a complaint (an allegation, not a conviction) charging UK national Thalha Jubair over at least 120 intrusions and extortion of 47 US entities by a group known as Scattered Spider, with at least USD 115 million in ransom paid. On 16 July 2026 the UK National Crime Agency announced that Jubair and Owen Flowers, described as leading members of Scattered Spider, had each been sentenced to five years and six months after pleading guilty to the 2024 attack on Transport for London. See the Threat Actor Groups Guide for how naming conventions differ between vendors.
Targeting and motivation
- Motivation: financial. Microsoft describes Octo Tempest's goal as financially motivated, and MITRE records data theft, ransomware and threats to leak data for financial gain (T1657).
- Early targets: MITRE says the group first targeted CRM providers, business process outsourcing (BPO) firms and telecommunications and technology companies. Mandiant notes that early operations largely targeted telecommunications organisations to support SIM swapping, and Microsoft reports the group sold SIM swaps to other criminals in 2022.
- Expansion: from 2023, according to MITRE, gaming, hospitality, retail, managed service providers, manufacturing and finance; Mandiant adds media and entertainment.
- Selection criterion: Mandiant says the group specifically targets organisations with large help desk and outsourced IT functions; CISA's 2023 advisory likewise names large companies and their contracted IT help desks.
- Ransomware: MITRE records BlackCat (ALPHV) and DragonForce ransomware used to encrypt files, including on VMware ESXi servers (T1486).
On 29 July 2025 CISA announced an updated joint advisory with the FBI and Canadian, Australian and UK partners, adding tactics seen in FBI investigations through June 2025. This profile uses that announcement and MITRE's current entry, not the full updated text; read the advisory for its latest indicators.
Tactics and techniques (MITRE ATT&CK)
All IDs are ATT&CK v20 entries in MITRE's G1015 list. The impersonation ID in CISA's 2023 advisory is now revoked; use T1684.001.
| Tactic | Technique | What sources describe | Primary defence |
|---|---|---|---|
| Reconnaissance | T1598.004 Spearphishing Voice | Calls to help desks and to employees, directing them to fake login portals | Out-of-band call-back verification |
| Stealth | T1684.001 Impersonation | Help desk staff compelled to reset passwords and MFA tokens | Strong caller verification and approval for privileged resets |
| Credential access | T1621 MFA Request Generation | Repeated MFA prompts sent to targets | Number matching or phishing-resistant MFA |
| Persistence | T1556.006 Multi-Factor Authentication | Attacker registers its own MFA tokens after compromise | Alert on new authenticator registration |
| Defence impairment | T1556.009 Conditional Access Policies | Extra trusted locations added to Azure AD Conditional Access | Change control and alerting on named locations |
| Privilege escalation | T1484.002 Trust Modification | Federated identity provider added to the SSO tenant with automatic account linking | Alert on federation and IdP changes |
| Command and control | T1219.002 Remote Desktop Software | TeamViewer, AnyDesk, LogMeIn, ngrok and ConnectWise deployed or users told to run them | Allowlist approved remote tools |
| Credential access | T1003.003 NTDS | NTDS.dit extracted via shadow copies of virtual domain controller disks | Restrict hypervisor and vCenter access |
| Collection | T1213.005 Messaging Applications | Slack and Teams searched for conversations about the intrusion and response | Out-of-band incident communications |
| Exfiltration | T1567.002 Exfiltration to Cloud Storage | Data sent to MEGA, Snowflake and AWS S3 | Egress controls and cloud storage monitoring |
| Impact | T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery | BlackCat and DragonForce encryption, including ESXi; Volume Shadow Copy service stopped | Offline, immutable, tested backups |
How they abuse identities and credentials
Human identities
- Help desk resets: Microsoft describes socially engineering the help desk to reset an administrator's password and to change or add MFA methods. Mandiant calls the group very prolific at impersonating users when contacting the help desk. See the Account Recovery and Help Desk Security Guide.
- MFA bypass: prompt bombing (T1621), phishing pages that harvest credentials (T1598.003), SIM swapping in early operations and registration of attacker-controlled authenticators. See the MFA Fatigue and Bypass Guide.
- Session theft: browser cookies taken with Raccoon Stealer (T1539), sidestepping MFA.
Identity infrastructure and machine credentials
- Identity provider control: once an administrator is compromised, the group changes the identity plane itself: federation trusts, Conditional Access locations and cloud role assignments. A rogue federated IdP survives password resets of the original account.
- Secrets and non-human credentials: MITRE records searches for credential documentation on hosts (T1552.001), enumeration and theft of code-signing certificates (T1552.004), and searches of password vaults and PAM tools, including HashiCorp Vault (T1555.005). Cloud access is then used to create EC2 instances (T1578.002) and to use existing ones for lateral movement (T1021.007).
- Virtualisation layer: MITRE and Mandiant describe vSphere administrator accounts identified, accounts added to the ESX Admins group (T1098) and SSH used to reach vCenter (T1021.004), putting domain controllers and the ransomware target within reach.
Notable incidents
Victim filings rarely name the group, so the table shows how each source frames attribution.
| Incident | What the source says | Attribution as published |
|---|---|---|
| Twilio Breach 2022 | Part of the 0ktapus campaign, which Group-IB said compromised 9,931 accounts at more than 130 organisations using 169 phishing domains | 0ktapus overlaps with Scattered Spider (MITRE alias, Microsoft); not shown to be the same actor |
| Caesars Entertainment Breach 2023 | Form 8-K (14 September 2023): a social engineering attack on an outsourced IT support vendor; loyalty programme database including driver's licence and social security numbers acquired | The 8-K does not name the group; attribution comes from public reporting |
| MGM Resorts Breach 2023 | Form 8-K (5 October 2023): an expected negative impact of approximately USD 100 million on Adjusted Property EBITDAR; some customer names, contact details and driver's licence numbers obtained | The 8-K names neither the group nor the help desk vector; both come from public reporting |
| Marks and Spencer Cyberattack 2025 | The chair told MPs it was a sophisticated impersonation involving a third party (Computing, October 2025); M&S estimated the cost at about GBP 300 million | Reported link to Scattered Spider; NCA arrests in July 2025 for the M&S, Co-op and Harrods attacks did not name a group |
| Co-op Cyber Attack 2025 | Co-op's chief executive confirmed data of all 6.5 million members was taken, with no financial or transaction data (as reported by CyberInsider, July 2025) | Reported as linked to DragonForce and Scattered Spider; no primary attribution statement read |
In May 2025 the NCSC said it could not yet say whether the UK retail attacks were linked, and published defensive advice drawn on below.
Detection and defence
Controls that break the playbook
- Help desk verification: NCSC advises reviewing how the help desk authenticates staff before resets. Never reset MFA or a privileged password on knowledge-based answers: call back on a number from the HR system and require a second approver for privileged accounts. Mandiant's guidance calls for rigorous identity controls for password resets and MFA registration.
- Phishing-resistant MFA: CISA and the FBI recommend FIDO/WebAuthn or PKI-based MFA, starting with administrators. It defeats prompt bombing and fake portals, not a help desk that re-enrols an attacker. See the Phishing-Resistant MFA Guide.
- Segregated admin identities: Mandiant recommends segregating identities across infrastructure. Keep identity provider, cloud, vSphere and backup admin accounts separate from email-enabled accounts, isolate ESXi and vCenter access as Mandiant advises, and use just-in-time roles (Microsoft points to Entra Privileged Identity Management).
- Remote tool allowlisting: CISA recommends inventorying and allowlisting remote access software and permitting remote access only through approved channels such as VPN or VDI. See the RMM Tool Security Guide.
- Out-of-band response: the group reads Slack, Teams and email about the response, so Microsoft strongly encourages out-of-band channels; set them up in advance.
- Recoverable backups: CISA recommends offline, encrypted, immutable backups that are tested.
Detection signals
| Signal | Where to look | Technique |
|---|---|---|
| Password reset followed within minutes by new MFA registration on the same account | Help desk ticketing plus Entra audit log ("Reset password (by admin)", "User registered security info") or Okta System Log (user.account.reset_password, user.mfa.factor.activate) | T1684.001, T1556.006 |
| New or changed federated domain or identity provider | Entra audit log ("Set domain authentication", "Set federation settings on domain") | T1484.002 |
| Named location added or changed in Conditional Access | Entra audit log, Policy category | T1556.009 |
| Risky sign-ins or admin sign-ins from residential VPN or unusual ranges | Entra ID Protection risky sign-ins; IdP sign-in logs (NCSC advice) | T1078.004 |
| Unapproved remote management or tunnelling software executing | EDR process telemetry against the allowlist | T1219.002, T1572 |
| Inbox rules deleting security alerts on security staff mailboxes | Exchange Online audit log (New-InboxRule, Set-InboxRule) | T1564.008 |
Correlating these signals is ITDR's job. See the ITDR Guide.
Rollout in four phases
- Weeks 1 to 2: change the help desk procedure for privileged accounts first (call-back plus second approver), brief agents and any outsourced provider, and keep a documented break-glass path for genuinely locked-out administrators.
- Weeks 3 to 6: enforce phishing-resistant MFA for all administrators, alert on authenticator registration, federation and Conditional Access changes, and set up out-of-band response channels.
- Weeks 7 to 12: run the remote tool allowlist in audit mode, review the hits, then enforce; segregate cloud, vSphere and backup admin identities.
- Test continuously: run authorised pretext calls against the help desk and a tabletop on the advisory's techniques, which CISA recommends validating controls against. If verification blocks too many genuine users, adjust the method, not the requirement.
Small vs large organisations: a small organisation with one IdP and an outsourced IT provider gains most from the help desk procedure, phishing-resistant MFA for a handful of admins and the provider's contract terms. Large organisations with in-house and outsourced service desks also need tiered admin identities and ITDR correlation, because resets happen at a volume no one reviews by hand.
Metrics
- Percentage of help desk password and MFA resets with a recorded out-of-band verification (target 100% for privileged accounts).
- Percentage of administrators using phishing-resistant MFA only.
- Median time from a privileged authenticator registration to analyst review.
- Number of unapproved remote access tools detected per month, trending to zero.
- Pretext call success rate in authorised help desk tests.
Common failure patterns
- Verifying callers on public data: employee IDs, managers and dates of birth are discoverable (T1589).
- Outsourced help desks without the same controls: the Caesars 8-K points to an outsourced IT support vendor. Contracts must require the same verification and logging.
- SMS and push MFA for administrators: the 0ktapus campaign captured one-time codes at scale, and the Uber Breach 2022 (a different actor) shows push fatigue working against a contractor account.
- Responding in the compromised tenant: containment talk in Teams or Slack tells the attacker what you know.
- Shared admin identities across planes: one compromised identity reaching the IdP, cloud and vCenter turns an account takeover into ransomware.
Framework mapping
| Control area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Help desk identity proofing and reset | IA-12, IA-5 | PR.AA-02 |
| Phishing-resistant MFA | IA-2(1), IA-2(2) | PR.AA-03 |
| Privileged and segregated admin accounts | AC-2, AC-6(5) | PR.AA-05 |
| Remote tool allowlisting and remote access | CM-7(5), AC-17 | PR.AA-05 |
| Social engineering awareness | AT-2(3) | PR.AT-01 |
| Identity and endpoint monitoring | SI-4 | DE.CM-03, DE.CM-09 |
| Outsourced IT and help desk providers | (contract controls) | GV.SC-07 |
| Backups and response | CP-9, IR-4 | PR.DS-11, RS.MA-01 |
Practitioner checklist
- Require out-of-band verification and a second approver for every privileged password or MFA reset, including at outsourced help desks.
- Move all administrators to phishing-resistant MFA and remove SMS and push fallbacks for them.
- Alert on new authenticator registration after a reset, federation changes and Conditional Access location changes.
- Separate identity provider, cloud, vSphere and backup admin accounts from everyday accounts, with just-in-time elevation.
- Allowlist approved remote access tools and alert on anything else.
- Prepare out-of-band incident communication channels before you need them.
- Keep offline, immutable backups and test restores.
- Run authorised pretext calls against the help desk and track the success rate.
Standards and references
- MITRE ATT&CK: Scattered Spider (G1015)
- CISA and FBI: Scattered Spider (AA23-320A)
- CISA: CISA and Partners Release Updated Advisory on Scattered Spider Group
- NCSC: Incidents impacting retailers, recommendations from the NCSC
- Microsoft: Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction
- Mandiant (Google Cloud): UNC3944 Proactive Hardening Recommendations
- US Department of Justice: United Kingdom National Charged in Connection with Multiple Cyber Attacks
- National Crime Agency: Two sentenced for hacking Transport for London
Related NHI Mgmt Group resources: Vishing and Smishing Guide · Okta Security Hardening Guide · Identity Provider and SSO Security Guide · Ransomware Groups Guide · Workforce Identity Security Guide