ThreatRoundup

Scattered Spider (Octo Tempest)

English-speaking cybercrime crew that phones IT help desks to reset MFA, then steals data and deploys ransomware; linked to the MGM Resorts and Transport for London attacks.

Threat actor profile · Updated

Active
2021 to September 2025
Origin
United States and United Kingdom (native English-speaking cybercriminals)
Type
Cybercrime
Affiliates
ALPHV/BlackCat (affiliate, 2023), RansomHub (affiliate, 2024), DragonForce ransomware (2025); self-styled Scattered LAPSUS$ Hunters persona (2025, claims); tactic overlaps with Google-tracked UNC6040/UNC6240 (ShinyHunters-branded extortion)
Regions targeted
United States, United Kingdom, Canada, other English-speaking countries, multinational companies
MITRE ATT&CK
G1015

What each vendor calls it

Microsoft
DEV-0971Octo TempestStorm-0875Storm-0971
CrowdStrike
Roasted 0ktapusScattered Spider
Google / Mandiant
UNC3944
Palo Alto Unit 42
Muddled Libra

Also known as 0ktapusOktapusScatter SwineScattered SwineStarfraud

See this actor in the Threat Actor Rosetta Stone →

Profile

Scattered Spider is a financially motivated cybercrime crew that breaks into large companies mostly by talking its way in. MITRE ATT&CK calls it a native English-speaking group active since at least 2022, and the people charged so far bear that out: the defendants named in US and UK court actions are mostly young US and British nationals, not the Russian-speaking operators behind most big ransomware brands. Microsoft, which tracks the group as Octo Tempest, noted in 2023 that Eastern European ransomware gangs had historically refused to work with English-speaking criminals, which made the group’s later ransomware partnerships a real shift. Mandiant (UNC3944), Unit 42 (Muddled Libra), CrowdStrike (Scattered Spider) and Group-IB (0ktapus) describe overlapping activity; Mandiant and Google treat UNC3944 as overlapping with, not identical to, the public “Scattered Spider” label.

The group started out stealing phone numbers. Microsoft says it surfaced in early 2022 hitting mobile carriers and business process outsourcing (BPO) firms to carry out SIM swaps, which it sold to other criminals or used to empty high-net-worth individuals’ cryptocurrency accounts. Group-IB’s 0ktapus report captured the wider 2022 campaign: text messages pointing employees at fake Okta sign-in pages, a phishing kit that pushed stolen passwords and one-time codes to a Telegram channel in real time, and nearly 10,000 credentials taken from more than 130 organizations. Twilio was one of the victims; Cloudflare got the same texts and was not, because its staff used FIDO2 hardware keys that a fake page can’t relay. The US Justice Department’s November 2024 case in Los Angeles charged five men over a text-phishing scheme of this kind running from September 2021 to April 2023.

Help desks are the signature target. The group phones a company’s IT service desk posing as an employee, uses personal details bought or stolen elsewhere to pass the security questions, and asks for a password or MFA reset, T1684.001 (Social Engineering: Impersonation). It also floods users with push prompts until one is approved, T1621 (Multi-Factor Authentication Request Generation), and enrolls its own phones as trusted MFA devices. CISA and the FBI laid this out in advisory AA23-320A (November 2023, updated July 2025), which also lists the legitimate remote-access tools the group has victims install, from ScreenConnect and AnyDesk to Fleetdeck, Level and Teleport. Unit 42’s 2025 assessment found that more than 70% of the callback numbers the group used in 2025 were Google Voice numbers, and in one case it went from a help-desk call to domain admin in about 40 minutes.

Once inside, it goes after the identity layer and the cloud rather than dropping a lot of malware. Mandiant documented compromised Okta accounts self-assigning every application in the tenant, Golden SAML attacks with stolen ADFS certificates, T1606.002 (Forge Web Credentials: SAML Tokens), new virtual machines spun up in vSphere and Azure to work from, and data pulled out of Salesforce with legitimate sync services such as Airbyte and Fivetran. Unit 42 saw the same move into AWS and Azure. Google’s 2025 vSphere guidance describes the end state: reset an admin’s password through the help desk, take over vCenter, detach a domain controller’s virtual disk to copy the Active Directory database below the reach of endpoint tools, wipe backups, then encrypt every ESXi host, all within hours.

Monetization has changed every year or so. In mid-2023 the group became an affiliate of the ALPHV/BlackCat ransomware operation, Microsoft and Mandiant report, and the September 2023 MGM Resorts attack, which MGM said cost it about $100 million, was widely attributed to it. Google says it moved to RansomHub in 2024 after ALPHV collapsed, and from April 2025 Unit 42, Microsoft and CISA place it alongside DragonForce ransomware. Its targeting tends to sweep one industry at a time: Microsoft lists retail, food services, hospitality, insurance and, most recently, airlines between April and July 2025. Google links the spring 2025 UK retail attacks to the group’s tactics but says it has not independently confirmed its involvement, and the UK National Crime Agency made four arrests over the Marks & Spencer, Co-op and Harrods attacks in July 2025. Microsoft also flags the aggression: in rare cases the group has threatened individual employees with their home addresses and families to get credentials.

Law enforcement has hit it harder than most crews. The five Los Angeles defendants are Ahmed Hossam Eldin Elbadawy, Noah Michael Urban, Evans Onyeaka Osiebo, Joel Martin Evans and Tyler Robert Buchanan; Urban, charged separately in Florida too, was sentenced to 10 years in August 2025, and Buchanan pleaded guilty to wire fraud conspiracy and aggravated identity theft in April 2026. In September 2025 US prosecutors in New Jersey charged Thalha Jubair, alleging he took part in about 120 intrusions whose victims paid more than $115 million in ransoms. In the UK, Jubair and Owen Flowers pleaded guilty over the 2024 Transport for London attack and were each jailed for five and a half years in July 2026. Peter Stokes, a 19-year-old US-Estonian dual citizen arrested at Helsinki airport in April 2026, faces a federal complaint in Chicago that accuses him of being a member. All charges against defendants who have not pleaded or been convicted are allegations.

Where it stands now is unclear. The UK National Crime Agency says the Jubair and Flowers arrests effectively halted the group’s activity but warns that others may keep using the name. In 2025 a Telegram persona calling itself “Scattered LAPSUS$ Hunters” has claimed attacks, including on Jaguar Land Rover, borrowing the Scattered Spider, ShinyHunters and Lapsus$ brands; those claims are largely unconfirmed. Google tracks the Salesforce vishing and extortion wave tied to the ShinyHunters name as UNC6040 and UNC6240, separate clusters with overlapping tactics, so treat “Scattered Spider did it” headlines from that period with care. In October 2026 Acronis, in a Qilin analysis ThreatRoundup covered, cited an alleged partnership between Scattered Spider and Qilin; we have not seen that confirmed by a primary source.

Events

Date Target Narrative Source Our coverage
2026-07-16 Not applicable (sentencing) Thalha Jubair, 20, and Owen Flowers, 18, each sentenced to five years and six months at Woolwich Crown Court for the 2024 Transport for London attack, after pleading guilty on June 22, the first day of their trial. The NCA calls them leading members and says their arrests effectively halted the group. UK National Crime Agency, UK National Crime Agency
2026-04 to 2026-07 Online communication platform (2023); multibillion-dollar US luxury retailer (2025) Peter Stokes (“Bouquet”) arrested at Helsinki airport on April 10 and extradited to Chicago, where a federal complaint charges fraud, conspiracy and computer intrusion offenses. It links him to at least four intrusions, including a May 2025 help-desk reset at a luxury retailer followed by an $8 million ransom demand the company refused. US Justice Department, BleepingComputer
2026-04 Technology companies and US cryptocurrency holders Tyler Robert Buchanan, 24, of Dundee, pleads guilty to wire fraud conspiracy and aggravated identity theft over the 2022 text-phishing and SIM-swap campaign; the Justice Department says he admitted stealing at least $8 million in virtual currency. US Justice Department, KrebsOnSecurity
2025-09 About 120 US organizations, including a critical infrastructure company and the US federal courts A New Jersey complaint charges UK national Thalha Jubair with computer fraud, wire fraud and money laundering conspiracy over intrusions from May 2022 to September 2025; prosecutors allege victims paid more than $115 million in ransoms. The NCA arrested Jubair and Owen Flowers in the UK two days earlier. US Justice Department
2025-09 Jaguar Land Rover (UK automaker) JLR shut down systems on Sept. 2 and production was disrupted. A group calling itself “Scattered LAPSUS$ Hunters” claimed responsibility and posted screenshots; JLR said it was investigating the claims, and neither data theft nor ransomware has been confirmed. Infosecurity Magazine
2025-08 Not applicable (sentencing) Noah Michael Urban, of Palm Coast, Florida, sentenced to 10 years in federal prison and ordered to pay $13 million in restitution after pleading guilty to wire fraud conspiracy, wire fraud and aggravated identity theft. American Banker
2025-04 to 2025-07 Retail, food services, hospitality, insurance and airlines in North America and the UK Microsoft sees Octo Tempest focus on one industry for weeks at a time, impersonating users to service desks, then deploying DragonForce ransomware against VMware ESX. Unit 42 adds government targets, and Google describes the vCenter takeover, offline theft of the domain controller disk and ESXi encryption, T1486 (Data Encrypted for Impact). Microsoft, Google, Unit 42
2025-07-10 Not applicable (arrests) The NCA arrests two 19-year-olds, a 17-year-old and a 20-year-old woman in the West Midlands and London over the April 2025 attacks on Marks & Spencer, Co-op and Harrods, on suspicion of Computer Misuse Act offenses, blackmail, money laundering and organized crime. UK National Crime Agency
2025-04 to 2025-05 UK retailers Google says public reporting points to Scattered Spider-style tactics against a UK retailer that then had DragonForce ransomware deployed, but it has not independently confirmed UNC3944’s involvement. Unit 42 dates the group’s work with DragonForce to at least April 2025. Google, Unit 42
2024-11 Not applicable (charges) Five men charged in Los Angeles over a text-phishing campaign against company employees from September 2021 to April 2023, used to steal credentials and then cryptocurrency: Ahmed Hossam Eldin Elbadawy, Noah Michael Urban, Evans Onyeaka Osiebo, Joel Martin Evans and Tyler Robert Buchanan. US Justice Department
2024-08 to 2024-09 Transport for London Network breached between Aug. 31 and Sept. 3, 2024; the NCA says 148 systems were knocked out, all 27,000 staff had to reset passwords in person, Oyster refund data was accessed, and losses and recovery costs reached £29 million. UK National Crime Agency
2023-08 to 2024-06 Organizations using Okta, vSphere, Azure, Salesforce and other SaaS platforms Mandiant sees UNC3944 shift to data-theft extortion without ransomware: help-desk MFA resets, Okta app self-assignment, new VMs created as footholds, T1578.002 (Modify Cloud Compute Infrastructure: Create Cloud Instance), and Salesforce data pulled out with Airbyte and Fivetran. Mandiant
2024 Not disclosed Google reports UNC3944 became a RansomHub affiliate after the ALPHV operation shut down. Google
2023 to 2024 AWS and Azure customers Unit 42 sees Muddled Libra abuse identity providers, including the mid-2023 Okta cross-tenant impersonation technique, then mine AWS Secrets Manager and S3 and exfiltrate through AWS DataSync and copied Azure snapshots. Unit 42
2023-11 Commercial facilities and other large organizations CISA and the FBI publish a joint advisory on the group’s help-desk social engineering, MFA fatigue and SIM swapping, T1566.004 (Phishing: Spearphishing Voice), and the remote-access tools it uses; the July 2025 update adds DragonForce, RattyRAT and bulk Snowflake data theft. CISA AA23-320A
2023-09 MGM Resorts (US casinos and hotels) Social engineering led to more than a hundred ESXi hypervisors encrypted, disrupting reservations, slot machines and card terminals; MGM estimated a roughly $100 million hit. The attack is attributed in reporting to Scattered Spider acting as an ALPHV/BlackCat affiliate. BleepingComputer
2023 (mid) Hospitality, retail, media, gaming and financial services The group becomes an ALPHV/BlackCat affiliate, starting with data-theft extortion and deploying the encryptor against ESXi by June 2023, Microsoft says. Mandiant sees it disable Defender protections before running ALPHV. Microsoft, Mandiant
2022-12 to 2023-01 Organizations running endpoint security products CrowdStrike catches the group abusing a vulnerable Intel Ethernet diagnostics driver (CVE-2015-2291) to load a malicious kernel driver that patches out security sensor routines, T1068 (Exploitation for Privilege Escalation). CrowdStrike
2022 (mid to late) Telecom and BPO companies CrowdStrike links, with low confidence, a campaign seeking access to mobile carrier networks: phone and Telegram impersonation of IT staff, MFA push fatigue, multiple RMM tools for persistence, and exploitation of a ForgeRock OpenAM flaw (CVE-2021-35464). CrowdStrike
2022-06 to 2022-08 Twilio; Cloudflare Texts sent to staff lead to fake Okta login pages. At Twilio, stolen credentials reached internal tools and data on 209 customers and 93 Authy users; Cloudflare’s hardware security keys stopped the same attack. Twilio, Cloudflare
2022-03 to 2022-08 More than 130 organizations, mostly US technology, software and cloud firms, plus financial and crypto companies Group-IB’s 0ktapus campaign: 169 phishing domains impersonating Okta, 9,931 credentials and 5,441 MFA codes stolen, T1566.002 (Phishing: Spearphishing Link), with access reused for follow-on supply-chain attacks. Group-IB
2021 (late) to 2022 Mobile carriers and their customers Earliest activity Mandiant dates to the group: the EIGHTBAIT phishing kit, then a focus on credentials and systems that enable SIM swapping. Microsoft dates its first SIM-swap operations to early 2022. Mandiant, Microsoft

Target vectors risk profile

Cloud/identity Help desks/BPO Telecom Technology/SaaS Ransomware/extortion Retail Hospitality/gaming Insurance Transportation/logistics Crypto/DeFi Finance Healthcare Government Manufacturing Critical infrastructure
High High High High High High High High High High Medium Medium Medium Medium Medium

Malware and tools

Name What it does Public detection Hunt Leads Reports
0ktapus / EIGHTBAIT phishing kits Okta-themed credential and one-time-code phishing pages that relay stolen logins to Telegram in real time Indicators in Group-IB’s report Group-IB, Mandiant
ScreenConnect, AnyDesk, Fleetdeck, Level, Splashtop, TeamViewer, Tactical RMM, Pulseway, Teleport Legitimate remote-access and RMM tools victims are talked into installing, or the group installs for persistence and C2 Tool list in CISA AA23-320A CISA AA23-320A, CrowdStrike
Malicious kernel driver with iqvw64.sys Bring-your-own-vulnerable-driver loader that uses CVE-2015-2291 to patch endpoint security drivers in memory Indicators in CrowdStrike’s report CrowdStrike
ALPHV/BlackCat Ransomware-as-a-service encryptor the group deployed against ESXi as an affiliate from 2023 Indicators in CISA AA23-353A Microsoft, Mandiant
DragonForce Ransomware used with the group’s intrusions from 2025, including against VMware ESXi None published Microsoft, Unit 42, CISA AA23-320A
RattyRAT, AveMaria (WarZone), Raccoon Stealer, Vidar Java RAT and commodity RAT and infostealers listed in the joint advisory Indicators in CISA AA23-320A CISA AA23-320A
AADInternals, Mimikatz, Impacket, ngrok, Chisel, rsocx Dual-use tools for Golden SAML and Entra ID abuse, credential dumping, lateral movement and tunneling None published Microsoft, Mandiant
Airbyte, Fivetran, AWS DataSync Legitimate data-sync services abused to move stolen SaaS and cloud data to attacker storage None published Mandiant, Unit 42

Reports

Date Source Report
2026-07-16 UK National Crime Agency Two sentenced for hacking Transport for London in UK’s biggest ever cyber crime case
2026-07-02 BleepingComputer Alleged Scattered Spider hacker extradited to the United States
2026-06-22 UK National Crime Agency Cyber criminals who hacked into Transport for London’s computer network are convicted
2026-04-21 KrebsOnSecurity Scattered Spider member “Tylerb” pleads guilty
2025-09-18 US Justice Department United Kingdom national charged in connection with multiple cyber attacks, including on critical infrastructure
2025-07-29 CISA, FBI and partners Scattered Spider (AA23-320A, updated; first published Nov. 16, 2023)
2025-07-25 Unit 42 Muddled Libra threat assessment: further-reaching, faster, more impactful
2025-07-23 Google Threat Intelligence Group From help desk to hypervisor: defending your VMware vSphere estate from UNC3944
2025-07-16 Microsoft Protecting customers from Octo Tempest attacks across multiple industries
2025-07-10 UK National Crime Agency Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods
2025-05-06 Google Threat Intelligence Group Defending against UNC3944: cybercrime hardening guidance from the frontlines
2024-11-20 US Justice Department 5 defendants charged federally with running scheme that targeted victim companies via phishing text messages
2024-06-13 Mandiant UNC3944 targets SaaS applications
2024-04-09 Unit 42 Muddled Libra’s evolution to the cloud
2023-10-25 Microsoft Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction
2023-09-14 Mandiant Why are you texting me? UNC3944 leverages SMS phishing campaigns for SIM swapping, ransomware, extortion, and notoriety
2023-01-10 CrowdStrike SCATTERED SPIDER exploits Windows security deficiencies with bring-your-own-vulnerable-driver tactic in attempt to bypass endpoint security
2022-12-01 CrowdStrike Not a SIMulation: CrowdStrike investigations reveal intrusion campaign targeting telco and BPO companies
2022-08-25 Group-IB Roasting 0ktapus: the phishing campaign going after Okta identity credentials
2022-08-09 Cloudflare The mechanics of a sophisticated phishing scam and how we stopped it
2022-08-07 Twilio Incident report: employee and customer account compromise

Vulnerabilities exploited

Vulnerability CVSS Severity Publisher Platform CISA KEV
CVE-2021-35464 9.8 Critical ForgeRock ForgeRock Access Management (OpenAM) Yes
CVE-2015-2291 7.8 High Intel Ethernet diagnostics driver for Windows (iqvw64.sys) Yes

If you’re in their sights

Do this now

  1. Lock down your help desk. No password or MFA resets over the phone for admins and other privileged accounts; require a callback to a number already on file, a manager’s approval, or a video or in-person check, and treat “I got a new phone” as the classic opener. Make sure outsourced service desks follow the same rules.
  2. Move staff, and above all admins, to phishing-resistant MFA (FIDO2 security keys or passkeys). Cloudflare shrugged off the 2022 campaign that hit Twilio because a fake page can’t relay a hardware key. Alert on every new MFA device registration and on bursts of push prompts.
  3. Allow only the remote-access tools you actually use and block or alert on the rest (ScreenConnect, AnyDesk, Fleetdeck, Level, Teleport, ngrok and similar), especially new installs right after a help-desk ticket.
  4. Watch the identity layer: Okta or Entra admins assigning themselves apps, new federated identity providers or trust changes, ADFS certificate exports, and new cloud VMs nobody requested.
  5. Harden vSphere and backups before you need to: lockdown mode and execInstalledOnly on ESXi, SSH off on vCenter, ESXi hosts not joined to Active Directory, and backups in a separate, non-domain-joined, immutable environment.

Compiled from US Justice Department and UK National Crime Agency actions, CISA and FBI, Microsoft, Mandiant and Google Threat Intelligence Group, Unit 42, CrowdStrike, Group-IB, Twilio, Cloudflare, BleepingComputer, KrebsOnSecurity, Infosecurity Magazine, American Banker and MITRE ATT&CK, plus ThreatRoundup reporting. Last reviewed November 1, 2026.

ATT&CK techniques (64)

Techniques MITRE ATT&CK links to this group from public reporting, grouped by tactic. A technique can sit under more than one tactic.

Reconnaissance 4
Resource Development 4
Initial Access 3
Execution 3
Persistence 9
Privilege Escalation 7
Stealth 6
Defense Impairment 6
Credential Access 8
Discovery 11
Lateral Movement 3
Collection 6
Command and Control 4
Exfiltration 2
Impact 3

Software MITRE links to this group (10)

BlackCat ConnectWise LaZagne Mimikatz ngrok Raccoon Stealer Rclone Tor Vidar WarzoneRAT

ATT&CK techniques and software from MITRE ATT&CK (v20.0); vendor names from MITRE ATT&CK and the MISP galaxy. © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MISP galaxy content is CC0 / BSD-2-Clause.