Actors/Cybercrime/Americas

UNC3944

CRIMEUS · United States

AKA Roasted 0ktapus · Octo Tempest · Scatter Swine · Muddled Libra · Star Fraud · 0ktapus · Scattered Lapsus$ Hunters · Storm-0971

CrowdStrike: Scattered SpiderMicrosoft: Storm-0875

Native-English-speaking eCrime collective known for social-engineering helpdesks.

Targets20

Sectors19

Threat types2

GIRs mapped0/480

Active since2022

Explore in atlas

MERGED INTOScattered Spiderscattered-spider

Also tracked as

3 vendor names · 8 other aliases

Open Rosetta Stone

CrowdStrike

Scattered Spider

Mandiant

UNC3944

Microsoft

Storm-0875

UNATTRIBUTED ALIASESRoasted 0ktapusOcto TempestScatter SwineMuddled LibraStar Fraud0ktapusScattered Lapsus$ HuntersStorm-0971

Victimology

Geographic footprint · 20 countries

Export STIX

origin · United Statestargeted countries · 20

OCEANIA · 1

Australia

AMERICAS · 3

Brazil · Canada · United States

EUROPE · 9

Switzerland · Germany · Spain · Finland · France · United Kingdom · Italy · Luxembourg · Sweden

ASIA · 7

Israel · India · Japan · South Korea · Philippines · Singapore · Thailand

Sectors targeted

19 of 40

Aerospace58 actors Financial Services73 actors Cryptocurrency20 actors Healthcare46 actors Pharmaceutical26 actors Telecom71 actors Retail & Hospitality32 actors Energy / Utilities58 actors Manufacturing (man)49 actors Media & Journalism48 actors Logistics21 actors Real Estate9 actors Hospitality32 actors Transport & Logistics6 actors Food and Beverage9 actors Legal & Professional17 actors Consulting / Professional Services34 actors Industrials / Engineering28 actors Consumer Goods / Electronics19 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ext · ExtortionRAN · Ransomware

MITRE ATT&CK · 40 techniques

Reconnaissance · 1

T1598Phishing for Information

Initial Access · 1

T1566Phishing

Execution · 4

T1059Command and Scripting Interpreter

Persistence · 3

T1098Account Manipulation T1136Create Account

Privilege Escalation · 1

T1068Exploitation for Privilege Escalation

Credential Access · 5

T1003.003NTDS T1552.001Credentials In Files

Discovery · 6

T1016System Network Configuration Discovery

Lateral Movement · 3

T1021.001Remote Desktop Protocol T1021.004SSH

Collection · 3

T1074Data Staged

Exfiltration · 2

T1041Exfiltration Over C2 Channel T1567.002Exfiltration to Cloud Storage

Impact · 3

T1486Data Encrypted for Impact

Command And Control · 3

T1090Proxy

Defense Impairment · 2

T1578.002Create Cloud Instance T1685Disable or Modify Tools

Stealth · 3

T1078Valid Accounts

GIR mappings

0 / 480 requirements mapped

Open matrix

No GIRs mapped yet for this actor.

References

No supporting references have been recorded for this profile. Treat uncited claims as unverified.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer40 techniques · layer format 4.5

Related actors

By origin and actor type

T1059.001

PowerShell

T1059.004Unix Shell

T1204User Execution

T1543.002

Systemd Service

T1552.004

Private Keys

T1555.005Password Managers

T1621Multi-Factor Authentication Request Generation

T1018

Remote System Discovery

T1083File and Directory Discovery

T1087Account Discovery

T1217Browser Information Discovery

T1538Cloud Service Dashboard

T1021.007

Cloud Services

T1114.003

Email Forwarding Rule

T1213.005Messaging Applications

T1490

Inhibit System Recovery

T1657Financial Theft

T1105

Ingress Tool Transfer

T1219.002Remote Desktop Software

T1078.004

Cloud Accounts

T1684.001Impersonation