⌘K

Scattered Spider (aka UNC3944, Octo Tempest) · APT Atlas

Actors/Cybercrime/Americas

Scattered Spider

G1015CRIMEUS · United States

AKA UNC3944 · Octo Tempest · Roasted 0ktapus · Storm-0875 · Muddled Libra · Oktapus · Scattered Swine · Scatter Swine · 0ktapus · Storm-0971 · DEV-0971 · Starfraud · Star Fraud · LUCR-3

MITRE: G1015

Native-English-speaking eCrime collective known for social-engineering helpdesks.

Targets3

Sectors3

Threat types1

GIRs mapped0/480

Active since2022

Explore in atlas

Export

STIX 2.1 ATT&CK Navigator

QUICK FACTS

TypeCybercrime

OriginUnited States

First seen2022

Type (verbatim)eCrime

GIR mappings0/480

TTPs13

Targets3

Sectors3

Record updated2026-08-03

Also tracked as

1 vendor names · 14 other aliases

Open Rosetta Stone

MITRE

G1015

UNATTRIBUTED ALIASESUNC3944Octo TempestRoasted 0ktapusStorm-0875Muddled LibraOktapusScattered SwineScatter Swine0ktapusStorm-0971DEV-0971StarfraudStar FraudLUCR-3

Victimology

Geographic footprint · 3 countries

Export STIX

origin · United Statestargeted countries · 3

AMERICAS · 2

Canada · United States

EUROPE · 1

United Kingdom

Sectors targeted

3 of 40

Financial Services73 actors Telecom71 actors Retail & Hospitality32 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

RAN · Ransomware

MITRE ATT&CK · 13 techniques

Reconnaissance · 1

T1589Gather Victim Identity Information

Resource Development · 1

T1583.001Domains

Persistence · 1

T1133External Remote Services

Credential Access · 1

T1539Steal Web Session Cookie

Discovery · 4

T1069Permission Groups Discovery T1069.002Domain Groups

Collection · 2

T1114Email Collection

Command And Control · 1

T1572Protocol Tunneling

Stealth · 2

T1006Direct Volume Access

GIR mappings

0 / 480 requirements mapped

Open matrix

No GIRs mapped yet for this actor.

References

1 external sources

Scattered Spider (G1015)MITRE ATT&CKanalysis
Associated Groups: UNC3944
Supports: aliases · Reviewed 2026-10-05

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer13 techniques · layer format 4.5

Related actors

By origin and actor type

DEV-0537cybercrime

unattributed · 7 targets · since 2021

Equation Groupnation-state

United States · 0 targets · since 2001

Evil Corpcybercrime

Russia · 11 targets · since 2007

FIN1cybercrime

Russia · 3 targets · since 2008

FIN10cybercrime

unattributed · 1 targets · since 2013

FIN11cybercrime

Russia · 25 targets · since 2017

T1082

System Information Discovery

T1580Cloud Infrastructure Discovery

T1530

Data from Cloud Storage

T1564.008

Email Hiding Rules