Scattered Spider

Names and who uses them

• Scattered SpiderOur name
• Roasted 0ktapusCrowdStrike
• UNC3944Mandiant
• Octo TempestMicrosoft
• Storm-0875Microsoft

Targets

Sectors: Healthcare, Finance, Telecommunications, Technology, Manufacturing, Retail, Hospitality

Known techniques

• T1003.003NTDS
• T1006Direct Volume Access
• T1016System Network Configuration Discovery
• T1018Remote System Discovery
• T1021.001Remote Desktop Protocol
• T1021.004SSH
• T1021.007Cloud Services
• T1041Exfiltration Over C2 Channel
• T1059.001PowerShell
• T1059.004Unix Shell
• T1068Exploitation for Privilege Escalation
• T1069Permission Groups Discovery
• T1069.002Domain Groups
• T1070.008Clear Mailbox Data
• T1074Data Staged
• T1078Valid Accounts
• T1078.004Cloud Accounts
• T1082System Information Discovery
• T1083File and Directory Discovery
• T1087Account Discovery
• T1087.002Domain Account
• T1090Proxy
• T1098Account Manipulation
• T1098.003Additional Cloud Roles
• T1105Ingress Tool Transfer
• T1114Email Collection
• T1114.003Email Forwarding Rule
• T1133External Remote Services
• T1136Create Account
• T1204User Execution
• T1213.003Code Repositories
• T1213.005Messaging Applications
• T1217Browser Information Discovery
• T1219.002Remote Desktop Software
• T1484.002Trust Modification
• T1486Data Encrypted for Impact
• T1490Inhibit System Recovery
• T1530Data from Cloud Storage
• T1538Cloud Service Dashboard
• T1539Steal Web Session Cookie

Malware and tools used