Threat feed IOCs (0)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Scattered Spider. Each row shows why it was linked and where it came from.

No feed indicators linked to this actor yet. Feeds are checked every hour.

Public research & publications (13)

Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.

• attack.mitre.orghttps://attack.mitre.org/groups/G1015
• cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944
• cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations
• learn.microsoft.comhttps://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
• cisa.govhttps://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
• crowdstrike.comhttps://www.crowdstrike.com/adversaries/scattered-spider/
• crowdstrike.comhttps://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/
• crowdstrike.comhttps://www.crowdstrike.com/blog/scattered-spider-attempts-to-avoid-detection-with-bring-your-own-vulnerable-driver-tactic/
• microsoft.comhttps://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/
• cybersecurity-insiders.comhttps://www.cybersecurity-insiders.com/scattered-spider-managed-mgm-resort-network-outage-brings-8m-loss-daily/
• loginradius.comhttps://www.loginradius.com/blog/identity/oktapus-phishing-targets-okta-identity-credentials/
• attackiq.comhttps://www.attackiq.com/2023/11/21/attack-graph-response-to-cisa-advisory-aa23-320a/
• mandiant.comhttps://www.mandiant.com/resources/blog/unc3944-sms-phishing-sim-swapping-ransomware