Actors/Cybercrime/Americas

UNC3944

CRIMEUS · United States

AKA Roasted 0ktapus · Octo Tempest · Scatter Swine · Muddled Libra · Star Fraud

Microsoft: Storm-0875CrowdStrike: Scattered Spider

Native-English-speaking eCrime collective known for social-engineering helpdesks.

Targets20

Sectors19

Threat types2

GIRs covered0/480

Active since2022

Also tracked as

3 vendor names · 5 other aliases

Open Rosetta Stone

CrowdStrike

Scattered Spider

Mandiant

UNC3944

Microsoft

Storm-0875

UNATTRIBUTED ALIASESRoasted 0ktapusOcto TempestScatter SwineMuddled LibraStar Fraud

Victimology

Geographic footprint · 20 countries

origin · United Statestargeted countries · 20

OCEANIA · 1

Australia

AMERICAS · 3

Brazil · Canada · United States

EUROPE · 9

Switzerland · Germany · Spain · Finland · France · United Kingdom · Italy · Luxembourg · Sweden

ASIA · 7

Israel · India · Japan · South Korea · Philippines · Singapore · Thailand

Sectors targeted

19 of 40

Aerospace59 actors Financial Services74 actors Cryptocurrency21 actors Healthcare47 actors Pharmaceutical27 actors Telecom72 actors Retail & Hospitality33 actors Energy / Utilities59 actors Manufacturing (man)50 actors Media & Journalism49 actors Logistics22 actors Real Estate10 actors Hospitality33 actors Transport & Logistics7 actors Food and Beverage10 actors Legal & Professional18 actors Consulting / Professional Services35 actors Industrials / Engineering29 actors Consumer Goods / Electronics20 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ext · ExtortionRAN · Ransomware

MITRE ATT&CK · 40 techniques

Reconnaissance · 1

T1598Phishing for Information

Initial Access · 1

T1566Phishing

Execution · 4

T1059Command and Scripting Interpreter

Persistence · 3

T1098Account Manipulation T1136Create Account

Privilege Escalation · 1

T1068Exploitation for Privilege Escalation

Credential Access · 5

T1003.003NTDS T1552.001Credentials In Files

Discovery · 6

T1016System Network Configuration Discovery

Lateral Movement · 3

T1021.001Remote Desktop Protocol T1021.004SSH

Collection · 3

T1074Data Staged

Exfiltration · 2

T1041Exfiltration Over C2 Channel T1567.002Exfiltration to Cloud Storage

Impact · 3

T1486Data Encrypted for Impact

Command And Control · 3

T1090Proxy

Defense Impairment · 2

T1578.002Create Cloud Instance T1685Disable or Modify Tools

Stealth · 3

T1078Valid Accounts

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer40 techniques · layer format 4.5

Related actors

By origin and actor type

T1059.001

PowerShell

T1059.004Unix Shell

T1204User Execution

T1543.002

Systemd Service

T1552.004

Private Keys

T1555.005Password Managers

T1621Multi-Factor Authentication Request Generation

T1018

Remote System Discovery

T1083File and Directory Discovery

T1087Account Discovery

T1217Browser Information Discovery

T1538Cloud Service Dashboard

T1021.007

Cloud Services

T1114.003

Email Forwarding Rule

T1213.005Messaging Applications

T1490

Inhibit System Recovery

T1657Financial Theft

T1105

Ingress Tool Transfer

T1219.002Remote Desktop Software

T1078.004

Cloud Accounts

T1684.001Impersonation