Scattered Spider

☆ pin

MITRE G1015Also known as SCATTERED SPIDER, Muddled Libra, ScatteredSpider, Octo Tempest, UNC3944, 0ktapus, 0sect, Scattered Lapsus$ Hunters, Scatter Swine, Starfraud, The Com, Scattered Spider

Reports

First seen

Sep 14, 2023

Last seen

Aug 7, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Transport & Logistics ×7 Retail & E-commerce ×4 Financial Services ×2 Technology ×1 Hospitality ×1

Victim regions

×1

×7

United Kingdom×7

United States×6

Japan×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1486 Data Encrypted for Impact ×16T1566 Phishing ×15T1078 Valid Accounts ×12T1190 Exploit Public-Facing Application ×11T1041 Exfiltration Over C2 Channel ×10T1005 Data from Local System ×9T1566.002 Phishing: Spearphishing Link ×6T1219 Remote Access Software ×5T1598 Phishing for Information ×5T1555 Credentials from Password Stores ×5T1110 Brute Force ×5T1021 Remote Services ×4

Indicators

cve ×97filename ×18domain ×10registry_key ×3url ×1

Indicator values are available on Pro and via the API.

Recent reports

High

Scattered Spider

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

CrowdStrike Threat Hunts for Shell Command Obfuscation on VMware ESX

Cyber Brief July 2026 – EU Threat Intelligence Summary

Leading Scattered Spider members sentenced to 66 months for Transport for London cyberattack

Scattered Spider Operatives Sentenced to 5.5 Years for £29M TfL Ransomware Attack

Scattered Spider members sentenced to five years for Transport for London hack

Scattered Spider members sentenced to 5.5 years for £29M Transport for London cyberattack

ThreatsDay: Cloud Bucket Hijacking, Windows LPE Chain, Global Fraud Bust + 17 More Stories

FBI Traces Scattered Spider Hacker Using Windows Device ID in Luxury Jewelry Retailer Breach

Weekly Cybersecurity Recap: Proxy Botnets, Browser Ransomware, RATs, and Credential Stealers

Scattered Spider member Peter Stokes extradited to US on cybercrime charges

Scattered Spider member Peter Stokes extradited to US for ransomware and extortion charges

Teen suspect in Scattered Spider hacks extradited to US

19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges

Insurance giant Aflac discloses data breach after subsidiary hack

ThreatsDay Bulletin: Smart TV Proxyware, curl Vulnerabilities, API Platform Flaws, and Ransomware Trends

Scattered Spider Members Plead Guilty in Transport for London Cyberattack

Scattered Spider members plead guilty to hacking Transport for London

Two Scattered Spider members plead guilty in Transport for London cyberattack

DragonForce ransomware uses custom Backdoor.Turn malware to hide C2 traffic in Microsoft Teams relays

Threats to the 2026 FIFA World Cup: Physical Security, Cyber, and Influence Operations Risk Assessment

2026 World Cup: Cyber Attack Surface and Threat Assessment

Inside the RaaS Ecosystem: Operators, Affiliates & Attack Tradecraft

CrowdStrike 2026 Financial Services Threat Landscape Report Overview

'Scattered Spider' member pleads guilty to wire fraud and identity theft

Why LinkedIn is a hunting ground for threat actors – and how to protect yourself

Risky Business #810 — Data extortion attacks have a silver lining

Risky Business #799 — Multiple critical vulnerabilities and breaches across tech vendors

Infostealers Crash Course: A Tradecraft Tuesday Recap

Scattered Spider hijacking MX records; Lumma Stealer, Qakbot takedowns

Defender Exclusions: How Adversaries Abuse Microsoft Defender Settings