Scattered Spider

☆ pin

MITRE G1015Also known as SCATTERED SPIDER, Muddled Libra, ScatteredSpider, 0ktapus, UNC3944, Scatter Swine, Starfraud, Octo Tempest, Scattered Lapsus$ Hunters, 0sect, The Com, Hacker Com

Reports

First seen

Sep 14, 2023

Last seen

Sep 28, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Transport & Logistics ×7 Retail & E-commerce ×4 Technology ×2 Financial Services ×2 Hospitality ×1

Victim regions

×1

×7

United Kingdom×7

United States×7

Japan×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1566 Phishing ×17T1486 Data Encrypted for Impact ×17T1078 Valid Accounts ×14T1190 Exploit Public-Facing Application ×12T1041 Exfiltration Over C2 Channel ×11T1005 Data from Local System ×10T1566.002 Phishing: Spearphishing Link ×7T1219 Remote Access Software ×5T1555 Credentials from Password Stores ×5T1110 Brute Force ×5T1598 Phishing for Information ×5T1598.003 Spearphishing Link ×4

Indicators

cve ×158filename ×19domain ×14registry_key ×3url ×1

Indicator values are available on Pro and via the API.

Recent reports

High

Scattered Spider

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Weekly Security Recap: Citrix NetScaler Exploits, $387M Crypto Hack, Placeholder Domain Abuse

Early Scattered Spider member pleads guilty to cybercrime spree

CrowdStrike Threat Hunts for Shell Command Obfuscation on VMware ESX

Cyber Brief July 2026 – EU Threat Intelligence Summary

Leading Scattered Spider members sentenced to 66 months for Transport for London cyberattack

Scattered Spider Operatives Sentenced to 5.5 Years for £29M TfL Ransomware Attack

Scattered Spider members sentenced to five years for Transport for London hack

Scattered Spider members sentenced to 5.5 years for £29M Transport for London cyberattack

ThreatsDay: Cloud Bucket Hijacking, Windows LPE Chain, Global Fraud Bust + 17 More Stories

FBI Traces Scattered Spider Hacker Using Windows Device ID in Luxury Jewelry Retailer Breach

Weekly Cybersecurity Recap: Proxy Botnets, Browser Ransomware, RATs, and Credential Stealers

Scattered Spider member Peter Stokes extradited to US on cybercrime charges

Scattered Spider member Peter Stokes extradited to US for ransomware and extortion charges

Teen suspect in Scattered Spider hacks extradited to US

19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges

Insurance giant Aflac discloses data breach after subsidiary hack

ThreatsDay Bulletin: Smart TV Proxyware, curl Vulnerabilities, API Platform Flaws, and Ransomware Trends

Scattered Spider Members Plead Guilty in Transport for London Cyberattack

Scattered Spider members plead guilty to hacking Transport for London

Two Scattered Spider members plead guilty in Transport for London cyberattack

DragonForce ransomware uses custom Backdoor.Turn malware to hide C2 traffic in Microsoft Teams relays

Threats to the 2026 FIFA World Cup: Physical Security, Cyber, and Influence Operations Risk Assessment

2026 World Cup: Cyber Attack Surface and Threat Assessment

Inside the RaaS Ecosystem: Operators, Affiliates & Attack Tradecraft

CrowdStrike 2026 Financial Services Threat Landscape Report Overview

'Scattered Spider' member pleads guilty to wire fraud and identity theft

Why LinkedIn is a hunting ground for threat actors – and how to protect yourself

Risky Business #810 — Data extortion attacks have a silver lining

Risky Business #799 — Multiple critical vulnerabilities and breaches across tech vendors

Infostealers Crash Course: A Tradecraft Tuesday Recap