AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

G1015 · 36 ATT&CK techniques · 0 correlated reports

Scattered Spider

Aliases: Roasted 0ktapus, Octo Tempest, Storm-0875

Scattered Spider is a native English-speaking cybercriminal group that has been active since at least 2022. The group initially targeted customer relationship management and business-process outsourcing (BPO) firms as well as telecommunications and technology companies. Beginning in 2023, Scattered Spider expanded its operations to compromise victims in the gaming, hospitality, retail, MSP, manufacturing, and financial sectors. During campaigns, Scattered Spider has leveraged targeted social-engineering techniques, attempted to bypass popular endpoint security tools, and more recently, deployed ransomware for financial gain.

Open interactive actor investigation

ATT&CK techniques

T1598
Phishing for Information T1553.002
Code Signing T1556.009
Conditional Access Policies T1580
Cloud Infrastructure Discovery T1003.003
NTDS T1087.002
Domain Account T1484.002
Trust Modification T1564.008
Email Hiding Rules T1539
Steal Web Session Cookie T1552.004
Private Keys T1538
Cloud Service Dashboard T1486
Data Encrypted for Impact T1133
External Remote Services T1204
User Execution T1556.006
Multi-Factor Authentication T1083
File and Directory Discovery T1219
Remote Access Software T1657
Financial Theft T1213.003
Code Repositories T1098.003
Additional Cloud Roles T1621
Multi-Factor Authentication Request Generation T1213.005
Messaging Applications T1068
Exploitation for Privilege Escalation T1530
Data from Cloud Storage T1217
Browser Information Discovery T1006
Direct Volume Access T1136
Create Account T1018
Remote System Discovery T1567.002
Exfiltration to Cloud Storage T1598.004
Spearphishing Voice T1074
Data Staged T1021.007
Cloud Services T1578.002
Create Cloud Instance T1552.001
Credentials In Files T1114
Email Collection T1656
Impersonation

Correlated CTI and IR reports

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research