Would your help desk hold the line against Scattered Spider?
A cybercriminal group of native English speakers, active since at least 2022. It talks its way past help desks and MFA, then extorts large companies with data theft and ransomware.
Scattered Spider
- Origin
- Cybercrime
- Also known as
- Octo Tempest, UNC3944
- Lure
- MFA bombing How they get in
- Weapon
- Ransomware Their signature move
- Loot
- Money What they are after
- MITRE ATT&CK®
- Scattered Spider (G1015)
Try an exercise against this group
In an exercise against a group like this one, your team meets techniques like those documented for it, in the order a real attack would take. Afterwards the report shows where the attack was stopped.
Book a demo See all threat cards
The cards describe publicly known threat groups. They say nothing about who those groups target. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK® is a registered trademark of The MITRE Corporation.