Scattered Spider
Also reported as Octo Tempest, UNC3944, 0ktapus, Muddled Libra, Scatter Swine and 10 other names.
Reports per quarter
Techniques seen in the last two years
- T1486 8 reports in ATT&CK
- T1567.002 8 reports in ATT&CK
- T1078 6 reports in ATT&CK
- T1566.004 6 reports reports only
- T1087.002 5 reports in ATT&CK
- T1219 5 reports reports only
- T1018 4 reports in ATT&CK
- T1021.001 4 reports in ATT&CK
- T1041 4 reports in ATT&CK
- T1053.005 4 reports reports only
Show all 297 techniques Show fewer
- T1068 4 reports in ATT&CK
- T1083 4 reports in ATT&CK
- T1090 4 reports in ATT&CK
- T1134 4 reports reports only
- T1190 4 reports reports only
- T1572 4 reports in ATT&CK
- T1003.003 3 reports in ATT&CK
- T1016 3 reports in ATT&CK
- T1021 3 reports reports only
- T1027 3 reports reports only
- T1033 3 reports reports only
- T1059 3 reports reports only
- T1059.001 3 reports in ATT&CK
- T1059.006 3 reports reports only
- T1071.001 3 reports reports only
- T1078.002 3 reports reports only
- T1078.004 3 reports in ATT&CK
- T1087 3 reports in ATT&CK
- T1105 3 reports in ATT&CK
- T1114.002 3 reports reports only
- T1204 3 reports in ATT&CK
- T1213.002 3 reports reports only
- T1528 3 reports reports only
- T1566 3 reports reports only
- T1566.002 3 reports reports only
- T1570 3 reports reports only
- T1598 3 reports in ATT&CK
- T1621 3 reports in ATT&CK
- T1657 3 reports in ATT&CK
- T1003 2 reports reports only
- T1003.001 2 reports reports only
- T1021.004 2 reports in ATT&CK
- T1021.006 2 reports reports only
- T1046 2 reports reports only
- T1053 2 reports reports only
- T1055 2 reports reports only
- T1056.001 2 reports reports only
- T1059.004 2 reports in ATT&CK
- T1069 2 reports in ATT&CK
- T1074 2 reports in ATT&CK
- T1074.002 2 reports reports only
- T1082 2 reports in ATT&CK
- T1090.001 2 reports reports only
- T1095 2 reports reports only
- T1102 2 reports reports only
- T1106 2 reports reports only
- T1112 2 reports reports only
- T1114 2 reports in ATT&CK
- T1114.003 2 reports in ATT&CK
- T1115 2 reports reports only
- T1119 2 reports reports only
- T1132.001 2 reports reports only
- T1133 2 reports in ATT&CK
- T1134.001 2 reports reports only
- T1136 2 reports in ATT&CK
- T1140 2 reports reports only
- T1195 2 reports reports only
- T1199 2 reports reports only
- T1204.001 2 reports reports only
- T1204.002 2 reports reports only
- T1210 2 reports reports only
- T1213 2 reports reports only
- T1213.003 2 reports in ATT&CK
- T1217 2 reports in ATT&CK
- T1489 2 reports reports only
- T1518 2 reports reports only
- T1526 2 reports reports only
- T1530 2 reports in ATT&CK
- T1538 2 reports in ATT&CK
- T1539 2 reports in ATT&CK
- T1546.008 2 reports reports only
- T1548 2 reports reports only
- T1548.002 2 reports reports only
- T1555.003 2 reports reports only
- T1556.006 2 reports in ATT&CK
- T1565 2 reports reports only
- T1566.001 2 reports reports only
- T1566.003 2 reports reports only
- T1567 2 reports reports only
- T1569.002 2 reports reports only
- T1573 2 reports reports only
- T1578 2 reports reports only
- T1583.001 2 reports in ATT&CK
- T1583.003 2 reports reports only
- T1584 2 reports reports only
- T1585.001 2 reports in ATT&CK
- T1585.002 2 reports reports only
- T1589.002 2 reports reports only
- T1593 2 reports reports only
- T0846 1 report reports only
- T1003.002 1 report reports only
- T1005 1 report reports only
- T1007 1 report reports only
- T1008 1 report reports only
- T1010 1 report reports only
- T1012 1 report reports only
- T1016.001 1 report reports only
- T1020 1 report reports only
- T1021.002 1 report reports only
- T1021.005 1 report reports only
- T1021.007 1 report in ATT&CK
- T1027.002 1 report reports only
- T1027.009 1 report reports only
- T1036.005 1 report reports only
- T1037 1 report reports only
- T1037.001 1 report reports only
- T1039 1 report reports only
- T1040 1 report reports only
- T1047 1 report reports only
- T1049 1 report reports only
- T1053.003 1 report reports only
- T1055.001 1 report reports only
- T1055.002 1 report reports only
- T1055.003 1 report reports only
- T1055.004 1 report reports only
- T1055.009 1 report reports only
- T1055.012 1 report reports only
- T1056 1 report reports only
- T1056.002 1 report reports only
- T1057 1 report reports only
- T1059.002 1 report reports only
- T1059.003 1 report reports only
- T1059.005 1 report reports only
- T1059.007 1 report reports only
- T1059.009 1 report reports only
- T1059.010 1 report reports only
- T1059.011 1 report reports only
- T1069.001 1 report reports only
- T1069.002 1 report in ATT&CK
- T1069.003 1 report reports only
- T1070 1 report reports only
- T1070.004 1 report reports only
- T1071 1 report reports only
- T1071.004 1 report reports only
- T1072 1 report reports only
- T1074.001 1 report reports only
- T1087.001 1 report reports only
- T1087.004 1 report reports only
- T1090.002 1 report reports only
- T1090.003 1 report reports only
- T1091 1 report reports only
- T1098 1 report in ATT&CK
- T1098.001 1 report reports only
- T1098.003 1 report in ATT&CK
- T1098.004 1 report reports only
- T1098.005 1 report reports only
- T1098.006 1 report reports only
- T1098.007 1 report reports only
- T1102.002 1 report reports only
- T1104 1 report reports only
- T1110 1 report reports only
- T1110.004 1 report reports only
- T1111 1 report reports only
- T1113 1 report reports only
- T1114.001 1 report reports only
- T1120 1 report reports only
- T1123 1 report reports only
- T1124 1 report reports only
- T1125 1 report reports only
- T1129 1 report reports only
- T1132 1 report reports only
- T1134.004 1 report reports only
- T1135 1 report reports only
- T1136.001 1 report reports only
- T1136.002 1 report reports only
- T1136.003 1 report reports only
- T1137 1 report reports only
- T1137.006 1 report reports only
- T1189 1 report reports only
- T1195.002 1 report reports only
- T1200 1 report reports only
- T1201 1 report reports only
- T1203 1 report reports only
- T1212 1 report reports only
- T1213.001 1 report reports only
- T1218 1 report reports only
- T1218.011 1 report reports only
- T1451 1 report in ATT&CK
- T1482 1 report reports only
- T1484 1 report reports only
- T1484.001 1 report reports only
- T1484.002 1 report in ATT&CK
- T1485 1 report reports only
- T1490 1 report in ATT&CK
- T1491.002 1 report reports only
- T1496 1 report reports only
- T1497 1 report reports only
- T1497.001 1 report reports only
- T1505 1 report reports only
- T1505.003 1 report reports only
- T1505.004 1 report reports only
- T1518.001 1 report reports only
- T1529 1 report reports only
- T1534 1 report reports only
- T1537 1 report reports only
- T1543 1 report reports only
- T1543.002 1 report in ATT&CK
- T1543.003 1 report reports only
- T1543.004 1 report reports only
- T1546 1 report reports only
- T1546.003 1 report reports only
- T1546.004 1 report reports only
- T1546.012 1 report reports only
- T1546.015 1 report reports only
- T1547 1 report reports only
- T1547.001 1 report reports only
- T1547.002 1 report reports only
- T1547.005 1 report reports only
- T1547.009 1 report reports only
- T1550 1 report reports only
- T1550.001 1 report reports only
- T1550.002 1 report reports only
- T1552 1 report reports only
- T1552.001 1 report in ATT&CK
- T1552.004 1 report in ATT&CK
- T1552.005 1 report reports only
- T1553.002 1 report in ATT&CK
- T1554 1 report reports only
- T1555 1 report reports only
- T1555.005 1 report in ATT&CK
- T1555.006 1 report reports only
- T1556 1 report reports only
- T1556.009 1 report in ATT&CK
- T1558.003 1 report reports only
- T1559 1 report reports only
- T1560 1 report reports only
- T1560.001 1 report reports only
- T1560.002 1 report reports only
- T1563.002 1 report reports only
- T1565.001 1 report reports only
- T1567.001 1 report reports only
- T1568 1 report reports only
- T1569 1 report reports only
- T1571 1 report reports only
- T1573.001 1 report reports only
- T1573.002 1 report reports only
- T1574 1 report reports only
- T1574.001 1 report reports only
- T1574.011 1 report reports only
- T1578.002 1 report in ATT&CK
- T1578.005 1 report reports only
- T1580 1 report in ATT&CK
- T1583 1 report reports only
- T1583.006 1 report reports only
- T1584.001 1 report reports only
- T1585 1 report reports only
- T1586.003 1 report reports only
- T1587 1 report reports only
- T1587.003 1 report reports only
- T1588 1 report reports only
- T1588.003 1 report reports only
- T1588.004 1 report reports only
- T1588.007 1 report reports only
- T1589 1 report in ATT&CK
- T1589.001 1 report reports only
- T1591.002 1 report reports only
- T1593.001 1 report reports only
- T1594 1 report reports only
- T1595 1 report reports only
- T1595.002 1 report reports only
- T1597.002 1 report reports only
- T1598.002 1 report reports only
- T1598.004 1 report in ATT&CK
- T1602 1 report reports only
- T1602.001 1 report reports only
- T1602.002 1 report reports only
- T1606 1 report reports only
- T1608 1 report reports only
- T1608.001 1 report reports only
- T1608.002 1 report reports only
- T1608.003 1 report reports only
- T1608.004 1 report reports only
- T1608.005 1 report reports only
- T1608.006 1 report reports only
- T1611 1 report reports only
- T1613 1 report reports only
- T1614 1 report reports only
- T1614.001 1 report reports only
- T1615 1 report reports only
- T1619 1 report reports only
- T1620 1 report reports only
- T1622 1 report reports only
- T1648 1 report reports only
- T1650 1 report reports only
- T1652 1 report reports only
- T1654 1 report reports only
- T1660 1 report in ATT&CK
Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.
Also listed by ATT&CK
CVEs named in reports
- CVE-2008-2463
- CVE-2015-2291 KEV ransomware
- CVE-2017-0144 KEV ransomware
- CVE-2017-0199 KEV ransomware
- CVE-2017-11882 KEV ransomware
- CVE-2018-0171 KEV
- CVE-2018-13379 KEV ransomware
- CVE-2019-18935 KEV ransomware
- CVE-2020-0688 KEV ransomware
- CVE-2020-1472 KEV ransomware
- CVE-2020-3529
- CVE-2021-26084 KEV ransomware
Show all 114 CVEs Show fewer
- CVE-2021-27101 KEV ransomware
- CVE-2021-27102 KEV ransomware
- CVE-2021-27103 KEV ransomware
- CVE-2021-31207 KEV ransomware
- CVE-2021-31969
- CVE-2021-34473 KEV ransomware
- CVE-2021-34523 KEV ransomware
- CVE-2021-35211 KEV ransomware
- CVE-2021-35464 KEV ransomware
- CVE-2021-35587 KEV
- CVE-2021-40539 KEV ransomware
- CVE-2021-44228 KEV ransomware
- CVE-2022-1388 KEV ransomware
- CVE-2022-21587 KEV ransomware
- CVE-2022-21919 KEV
- CVE-2022-22954 KEV ransomware
- CVE-2022-22960 KEV
- CVE-2022-22972
- CVE-2022-26134 KEV ransomware
- CVE-2022-29464 KEV ransomware
- CVE-2022-30190 KEV ransomware
- CVE-2022-41040 KEV ransomware
- CVE-2022-41082 KEV ransomware
- CVE-2022-42455
- CVE-2022-47986 KEV ransomware
- CVE-2023-0669 KEV ransomware
- CVE-2023-20198 KEV
- CVE-2023-20269 KEV ransomware
- CVE-2023-20273 KEV
- CVE-2023-21839 KEV
- CVE-2023-22515 KEV ransomware
- CVE-2023-22518 KEV ransomware
- CVE-2023-23397 KEV
- CVE-2023-27350 KEV ransomware
- CVE-2023-27351 KEV ransomware
- CVE-2023-27532 KEV ransomware
- CVE-2023-28252 KEV ransomware
- CVE-2023-2868 KEV
- CVE-2023-29324
- CVE-2023-29360 KEV
- CVE-2023-34048 KEV
- CVE-2023-3421
- CVE-2023-34362 KEV ransomware
- CVE-2023-3466
- CVE-2023-3467
- CVE-2023-3519 KEV ransomware
- CVE-2023-35384
- CVE-2023-36036 KEV
- CVE-2023-36802 KEV
- CVE-2023-36884 KEV ransomware
- CVE-2023-38831 KEV ransomware
- CVE-2023-40044 KEV ransomware
- CVE-2023-42793 KEV ransomware
- CVE-2023-46604 KEV ransomware
- CVE-2023-46805 KEV ransomware
- CVE-2023-47246 KEV ransomware
- CVE-2023-4863 KEV
- CVE-2023-48788 KEV ransomware
- CVE-2023-4911 KEV
- CVE-2023-4966 KEV ransomware
- CVE-2023-50164
- CVE-2023-5129
- CVE-2024-0012 KEV ransomware
- CVE-2024-1708 KEV ransomware
- CVE-2024-1709 KEV ransomware
- CVE-2024-20953 KEV
- CVE-2024-21287 KEV
- CVE-2024-21887 KEV ransomware
- CVE-2024-21893 KEV ransomware
- CVE-2024-21983
- CVE-2024-26169 KEV ransomware
- CVE-2024-27198 KEV ransomware
- CVE-2024-32113 KEV
- CVE-2024-3400 KEV ransomware
- CVE-2024-35250 KEV
- CVE-2024-36104
- CVE-2024-37085 KEV ransomware
- CVE-2024-38245
- CVE-2024-38856 KEV
- CVE-2024-43554
- CVE-2024-45195 KEV
- CVE-2024-4577 KEV ransomware
- CVE-2024-47575 KEV
- CVE-2024-5910 KEV
- CVE-2024-9463 KEV
- CVE-2024-9464
- CVE-2024-9465 KEV
- CVE-2024-9466
- CVE-2024-9467
- CVE-2024-9474 KEV ransomware
- CVE-2025-10035 KEV ransomware
- CVE-2025-24893 KEV
- CVE-2025-29824 KEV ransomware
- CVE-2025-32433 KEV
- CVE-2025-49704 KEV ransomware
- CVE-2025-49706 KEV ransomware
- CVE-2025-53770 KEV ransomware
- CVE-2025-53771
- CVE-2025-55182 KEV ransomware
- CVE-2025-61882 KEV ransomware
- CVE-2025-6218 KEV
- CVE-2025-8088 KEV ransomware
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
Show all 135 reports Show fewer
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor BlackCat (Malware Family)
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor BlackCat (Malware Family)
-
Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Ave Maria (Malware Family)
-
Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
-
Subgroup: Scattered Spider - Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Subgroup: Scattered Spider - Threat Group Cards: A Threat Actor Encyclopedia
-
ALPHV, BlackCat Gang - Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor ALPHV, BlackCat Gang - Threat Group Cards: A Threat Actor Encyclopedia
-
Subgroup: Scattered Spider - Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Subgroup: Scattered Spider - Threat Group Cards: A Threat Actor Encyclopedia
-
Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor watchtower-2023-eoy-report-en
-
Stealing the LIGHTSHOW (Part Two) - LIGHTSHIFT and LIGHTSHOW
The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Stealing the LIGHTSHOW (Part Two) - LIGHTSHIFT and LIGHTSHOW
-
Stealing the LIGHTSHOW (Part Two) — LIGHTSHIFT and LIGHTSHOW
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Stealing the LIGHTSHOW (Part Two) — LIGHTSHIFT and LIGHTSHOW
-
I Solemnly Swear My Driver Is Up to No Good- Hunting for Attestation Signed Malware
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor I Solemnly Swear My Driver Is Up to No Good- Hunting for Attestation Signed Malware
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Not a SIMulation- CrowdStrike Investigations Reveal Intrusion Campaign Targeting Telco and BPO Companies
-
Roasting 0ktapus- The phishing campaign going after Okta identity credentials
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Roasting 0ktapus- The phishing campaign going after Okta identity credentials
-
APT Lazarus Targets Engineers with macOS Malware
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT Lazarus Targets Engineers with macOS Malware
Newest first. Details opens the report in Explore.