AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Scattered Spider
Aliases: Octo Tempest, Roasted 0ktapus, Scattered Spider, Storm-0875, UNC3944
[Scattered Spider](https://attack.mitre.org/groups/G1015) is a native English-speaking cybercriminal group active since at least 2022. (Citation: CrowdStrike Scattered Spider Profile) (Citation: MSTIC Octo Tempest Operations October 2023) The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. (Citation: MSTIC Octo Tempest Operations October 2023) [Scattered Spider](https://attack.mitre.org/groups/G1015) relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. (Citation: CISA Scattered Spider Advisory November 2023) (Citation: CrowdStrike Scattered Spider BYOVD January 2023) (Citation: Crowdstrike TELCO BPO Campaign December 2022) [Scattered Spider](https://attack.mitre.org/groups/G1015) had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. (Citation: Mandiant UNC3944 May 2025)
Open interactive actor investigation
ATT&CK techniques
T1003.003T1006T1016T1018T1021.001T1021.004T1021.007T1041T1059.001T1059.004T1068T1069T1069.002T1070.008T1074T1078T1078.004T1082T1083T1087T1087.002T1090T1098T1098.003T1105T1114T1114.003T1133T1136T1204T1213.003T1213.005T1217T1219.002T1484.002T1486T1490T1530T1538T1539T1543.002T1552.001T1552.004T1553.002T1555.005T1556.006T1556.009T1564.008T1567.002T1572T1578.002T1580T1583.001T1585.001T1588.001T1588.002T1589T1598T1598.003T1598.004T1621T1657T1684.001T1685
Correlated CTI and IR reports
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Mimikatz tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Tor tool reference — Explicit actor uses software relationship in pinned ATT&CK
- LaZagne tool reference — Explicit actor uses software relationship in pinned ATT&CK
- ngrok tool reference — Explicit actor uses software relationship in pinned ATT&CK
- ConnectWise tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Rclone tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1003.003 NTDS simulation — Exact active technique ID
- T1003.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1006 Direct Volume Access simulation — Exact active technique ID
- T1006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1016 System Network Configuration Discovery simulation — Exact active technique ID
- T1016 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1018 Remote System Discovery simulation — Exact active technique ID
- T1018 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.001 Remote Desktop Protocol simulation — Exact active technique ID
- T1021.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.004 SSH simulation — Exact active technique ID
- T1021.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.007 Cloud Services simulation — Exact active technique ID
- T1021.007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1041 Exfiltration Over C2 Channel simulation — Exact active technique ID
- T1041 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.001 PowerShell simulation — Exact active technique ID
- T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.004 Unix Shell simulation — Exact active technique ID
- T1059.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1068 Exploitation for Privilege Escalation simulation — Exact active technique ID
- T1068 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1069 Permission Groups Discovery simulation — Exact active technique ID
- T1069 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1069.002 Domain Groups simulation — Exact active technique ID
- T1069.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.008 Clear Mailbox Data simulation — Exact active technique ID
- T1070.008 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1074 Data Staged simulation — Exact active technique ID
- T1074 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078 Valid Accounts simulation — Exact active technique ID
- T1078 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.004 Cloud Accounts simulation — Exact active technique ID
- T1078.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1082 System Information Discovery simulation — Exact active technique ID
- T1082 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1083 File and Directory Discovery simulation — Exact active technique ID
- T1083 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1087 Account Discovery simulation — Exact active technique ID
- T1087 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1087.002 Domain Account simulation — Exact active technique ID
- T1087.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090 Proxy simulation — Exact active technique ID
- T1090 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1098 Account Manipulation simulation — Exact active technique ID
- T1098 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1098.003 Additional Cloud Roles simulation — Exact active technique ID
- T1098.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1114 Email Collection simulation — Exact active technique ID
- T1114 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1114.003 Email Forwarding Rule simulation — Exact active technique ID
- T1114.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1133 External Remote Services simulation — Exact active technique ID
- T1133 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1136 Create Account simulation — Exact active technique ID
- T1136 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204 User Execution simulation — Exact active technique ID
- T1204 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1213.003 Code Repositories simulation — Exact active technique ID
- T1213.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1213.005 Messaging Applications simulation — Exact active technique ID
- T1213.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1217 Browser Information Discovery simulation — Exact active technique ID
- T1217 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1219.002 Remote Desktop Software simulation — Exact active technique ID
- T1219.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1484.002 Trust Modification simulation — Exact active technique ID
- T1484.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1486 Data Encrypted for Impact simulation — Exact active technique ID
- T1486 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1490 Inhibit System Recovery simulation — Exact active technique ID
- T1490 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1530 Data from Cloud Storage simulation — Exact active technique ID
- T1530 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1538 Cloud Service Dashboard simulation — Exact active technique ID
- T1538 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1539 Steal Web Session Cookie simulation — Exact active technique ID
- T1539 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1543.002 Systemd Service simulation — Exact active technique ID
- T1543.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1552.001 Credentials In Files simulation — Exact active technique ID
- T1552.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1552.004 Private Keys simulation — Exact active technique ID
- T1552.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1553.002 Code Signing simulation — Exact active technique ID
- T1553.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1555.005 Password Managers simulation — Exact active technique ID
- T1555.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1556.006 Multi-Factor Authentication simulation — Exact active technique ID
- T1556.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1556.009 Conditional Access Policies simulation — Exact active technique ID
- T1556.009 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1564.008 Email Hiding Rules simulation — Exact active technique ID
- T1564.008 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1567.002 Exfiltration to Cloud Storage simulation — Exact active technique ID
- T1567.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1572 Protocol Tunneling simulation — Exact active technique ID
- T1572 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1578.002 Create Cloud Instance simulation — Exact active technique ID
- T1578.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1580 Cloud Infrastructure Discovery simulation — Exact active technique ID
- T1580 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.001 Domains simulation — Exact active technique ID
- T1583.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1585.001 Social Media Accounts simulation — Exact active technique ID
- T1585.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.001 Malware simulation — Exact active technique ID
- T1588.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.002 Tool simulation — Exact active technique ID
- T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1589 Gather Victim Identity Information simulation — Exact active technique ID
- T1589 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1598 Phishing for Information simulation — Exact active technique ID
- T1598 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1598.003 Spearphishing Link simulation — Exact active technique ID
- T1598.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1598.004 Spearphishing Voice simulation — Exact active technique ID
- T1598.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1621 Multi-Factor Authentication Request Generation simulation — Exact active technique ID
- T1621 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1657 Financial Theft simulation — Exact active technique ID
- T1657 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1684.001 Impersonation simulation — Exact active technique ID
- T1684.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1685 Disable or Modify Tools simulation — Exact active technique ID
- T1685 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Module 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idCompute, managed services, serverless, SaaS, and workload hardening
Cloud Security · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 2 — Reconnaissance and attack-surface mapping
Red Team & Offensive Security · explicit-nameModule 10 — Laboratories, tool discipline, and reporting
Red Team & Offensive Security · explicit-nameDefensive external attack-surface discovery and continuous monitoring
OSINT & Reconnaissance · explicit-namePeople, organizations, brands, suppliers, and relationship research
OSINT & Reconnaissance · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 11 — Mobile and thick-client security
Red Team & Offensive Security · explicit-name
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idCompute, managed services, serverless, SaaS, and workload hardening
Cloud Security · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 2 — Reconnaissance and attack-surface mapping
Red Team & Offensive Security · explicit-nameModule 10 — Laboratories, tool discipline, and reporting
Red Team & Offensive Security · explicit-nameDefensive external attack-surface discovery and continuous monitoring
OSINT & Reconnaissance · explicit-namePeople, organizations, brands, suppliers, and relationship research
OSINT & Reconnaissance · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 11 — Mobile and thick-client security
Red Team & Offensive Security · explicit-name