aol.pm

Scattered Spider

IntrusionSet · ATTACK:enterprise:G1015

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:G1015",
  "title": "Scattered Spider",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G1015",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--44d37b89-a739-4810-9111-0d2617a8939b",
  "external_id": "G1015",
  "domain": "enterprise",
  "created": "2023-07-05T17:54:54.789Z",
  "modified": "2026-09-11T19:37:15.760Z",
  "version": "3.0",
  "aliases": [
    "Scattered Spider",
    "Roasted 0ktapus",
    "Octo Tempest",
    "Storm-0875",
    "UNC3944"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Roasted 0ktapus"
    },
    {
      "source_name": "UNC3944"
    },
    {
      "source_name": "Octo Tempest"
    },
    {
      "source_name": "Storm-0875"
    },
    {
      "source_name": "CISA Scattered Spider Advisory November 2023",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"
    },
    {
      "source_name": "CrowdStrike Scattered Spider BYOVD January 2023",
      "url": "https://www.crowdstrike.com/blog/scattered-spider-attempts-to-avoid-detection-with-bring-your-own-vulnerable-driver-tactic/"
    },
    {
      "source_name": "CrowdStrike Scattered Spider Profile",
      "url": "https://www.crowdstrike.com/adversaries/scattered-spider/"
    },
    {
      "source_name": "Mandiant VMware vSphere JUL 2025",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"
    },
    {
      "source_name": "Mandiant UNC3944 May 2025",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"
    },
    {
      "source_name": "Microsoft Threat Actor Naming July 2023",
      "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
    },
    {
      "source_name": "MSTIC Octo Tempest Operations October 2023",
      "url": "https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/"
    },
    {
      "source_name": "Crowdstrike TELCO BPO Campaign December 2022",
      "url": "https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/"
    }
  ]
}

Explicit source assertions (75)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1598

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0697ae7e-2008-4674-a4ab-761fd5c15b4e

CrowdStrike Scattered Spider BYOVD January 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07aa4a45-85f6-4ec6-b079-389d29c44108

Mandiant UNC3944 May 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09ee94a2-db35-4932-9a77-b47364346186

CrowdStrike Scattered Spider BYOVD January 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1556.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ab99fc3-ca4f-4117-930a-26365243108a

MSTIC Octo Tempest Operations October 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1580

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--105550a6-3e85-4286-a4de-f7d0d68380ed

CrowdStrike Scattered Spider JUL 2025 · Mandiant UNC3944 May 2025 · MSTIC Octo Tempest Operations October 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--106dcc28-3070-4882-8751-1791d471d564

Mandiant VMware vSphere JUL 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1114.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1251a031-96c4-4188-8bb3-15e02979d61e

CrowdStrike Scattered Spider JUL 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1598.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--167c9690-53fa-4f54-a86c-971b70b62c82

Check Point Scattered Spider JUL 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18723832-1945-437e-a750-08b2557e88f8

Mandiant VMware vSphere JUL 2025 · Mandiant UNC3944 May 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c4654e5-eac8-41e1-8da9-f88cadc6cc20

CrowdStrike Scattered Spider JUL 2025 · Mandiant VMware vSphere JUL 2025 · MSTIC Octo Tempest Operations October 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d02066a-a26b-46fe-a9d6-731c8d8b0566

Mandiant VMware vSphere JUL 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--225f57e8-5001-4f20-b610-b62faf650fc9

CrowdStrike Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023 · Mandiant VMware vSphere JUL 2025 · MSTIC Octo Tempest Operations October 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1484.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--247e3bf6-21c9-444e-81f7-a0e0f9eed04b

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1087

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2655a359-4baf-4fa0-9f1d-a1f1cf178da1

Mandiant VMware vSphere JUL 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1564.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29d7545b-e5da-43ec-a491-2f8645f2de97

MSTIC Octo Tempest Operations October 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--325a293f-7b6e-4baf-bcb8-74550019e144

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35b7c6d7-521c-41f6-81fc-af2f67d8ad82

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37d9aa25-a250-45a2-913f-14bd906fb130

CrowdStrike Scattered Spider JUL 2025 · Check Point Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023 · Mandiant UNC3944 May 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a05b5c4-3810-4f0e-925e-04f02a6da511

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1589

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--407b4ab5-68fb-4be1-a2dd-6062dcfbedd6

Mandiant VMware vSphere JUL 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1538

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--450571d1-ce87-4017-bdc8-30fb2b6ae852

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:S0670

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--478544be-5304-423f-8065-0f11cd4cfade

Check Point Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47a9cbf2-d225-4cdd-ad8a-760e2c32f6cb

CrowdStrike Scattered Spider JUL 2025 · Check Point Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023 · Mandiant VMware vSphere JUL 2025 · MSTIC Octo Tempest Operations October 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:S1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--498002b0-1700-45f4-8404-27c1d19a074f

Mandiant UNC3944 May 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f5d7297-9636-42aa-8342-580658abd971

Mandiant VMware vSphere JUL 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f7a6812-5026-47ce-9424-e6658cec5e54

CrowdStrike Scattered Spider BYOVD January 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1021.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54d0d5d9-c601-4855-b2fb-7017ebf5adce

Mandiant VMware vSphere JUL 2025 · Mandiant UNC3944 May 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1204

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54de26f7-7981-49b8-a353-d342a89552c8

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1556.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55e1a1e9-689f-4242-8316-d59c309849d6

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1684.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d21c6ae-3b8b-4c3d-b71d-6d324ef80fa9

CISA Scattered Spider Advisory November 2023 · Mandiant UNC3944 May 2025 · MSTIC Octo Tempest Operations October 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1583.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6244249f-b0c9-46ba-bc8c-9f43f7655098

Check Point Scattered Spider JUL 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:S0349

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64205021-48f8-4dbb-a731-e9c921bbf7f1

MSTIC Octo Tempest Operations October 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:S0183

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6bbf1ed1-b15d-4740-9a23-1e292081f1d3

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6eba9c1c-e0ee-4efe-9e8a-f1abb7c1e01a

Check Point Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023 · Mandiant UNC3944 May 2025 · MSTIC Octo Tempest Operations October 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71061ed6-3edc-4ec9-a57d-0a8c66c9af82

Mandiant UNC3944 May 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75dcfc1b-016e-44ac-97c9-5a2eb3b76e50

CrowdStrike Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023 · Mandiant VMware vSphere JUL 2025 · Mandiant UNC3944 May 2025 · MSTIC Octo Tempest Operations October 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:S9050

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7abbf832-9ec7-45b2-98c8-e3dff4e6993e

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1543.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85a38210-d648-4bfc-8d44-28c3a08b481a

Mandiant VMware vSphere JUL 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1219.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87e0b924-d2a6-4e65-95ed-9500670bbe5c

CrowdStrike Scattered Spider JUL 2025 · Check Point Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023 · Mandiant UNC3944 May 2025 · Trellix Scattered Spider MO August 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1657

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--886630f6-b61c-4ec1-9680-145c02542eb7

CrowdStrike Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023 · Trellix Scattered Spider MO August 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1213.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e09a040-057f-4b15-80c3-e7e299b274df

CISA Scattered Spider Advisory November 2023 · MSTIC Octo Tempest Operations October 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1098.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93c5ae98-040a-453a-a90c-247972f8d0bc

MSTIC Octo Tempest Operations October 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1069

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--982751f5-40e1-4f10-a926-2c016393c652

Mandiant VMware vSphere JUL 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:S1148

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ddb8e61-9c8e-4fbe-a485-e440c14f42cd

Check Point Scattered Spider JUL 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:S0508

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a24aad94-40e4-43a4-b2a4-ed8bfd412dcb

CrowdStrike Scattered Spider JUL 2025 · Check Point Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1621

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3fef23a-9f22-4d7c-b9f1-3f05372e9d87

Check Point Scattered Spider JUL 2025 · CrowdStrike Scattered Spider BYOVD January 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6f54d8a-7659-4efb-b53b-0e05664bdd23

Mandiant VMware vSphere JUL 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b232c5da-2145-4602-a754-21d7e8af68a5

Mandiant UNC3944 May 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b7e52798-0764-4e01-b18a-81ec0d30c36f

Mandiant VMware vSphere JUL 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1213.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bf341c57-1bdf-4d7a-8c01-1d94acce69a8

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bfe6736d-9bda-4f6e-87f9-8e6f3364a915

CrowdStrike Scattered Spider BYOVD January 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c00bdbcc-fc8d-4abf-9901-2a5cf291e763

CrowdStrike Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c021a96d-e4f2-4bd7-b1eb-315c518f16ca

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c0f7db5b-a4cf-40b1-b581-2ae548ca6303

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1d557cf-646d-4cac-bd2a-20889431372f

MSTIC Octo Tempest Operations October 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1136

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb094cb6-145c-471b-beac-0895a632bb57

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cbd8ee31-9b73-40b7-b054-3620a29b021f

Mandiant UNC3944 May 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc49c969-b227-437b-9b63-4a464766ff04

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1069.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf9c2999-8432-4bcd-b74b-8d5655fcbd7c

CrowdStrike Scattered Spider JUL 2025 · Mandiant VMware vSphere JUL 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cfdbe994-9056-421f-b400-c423be11a890

CrowdStrike Scattered Spider JUL 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1555.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d474431a-8b2b-4e17-9cbf-e0b28eb00d1a

Mandiant VMware vSphere JUL 2025 · Mandiant UNC3944 May 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d4c936f5-2221-4f6d-9d49-c6f499b07c9e

CrowdStrike Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023 · MSTIC Octo Tempest Operations October 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1598.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dbec2814-4a92-4ab7-a007-123b40b16d0b

CrowdStrike Scattered Spider JUL 2025 · Mandiant VMware vSphere JUL 2025 · MSTIC Octo Tempest Operations October 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1074

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc10559e-6a98-4a5f-abcd-adff67bfb1cd

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:S1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dd689e6a-443d-4465-b637-a7befde5e052

Check Point Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023 · Mandiant UNC3944 May 2025 · MSTIC Octo Tempest Operations October 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1078.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de08b4d6-06a5-441f-aafe-5cb505136efe

CrowdStrike Scattered Spider JUL 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1070.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e07d39ba-56a0-4323-964a-db27f56359af

CrowdStrike Scattered Spider JUL 2025

ATTACK:enterprise:C0027 → attributed-to → ATTACK:enterprise:G1015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e662ff77-e38c-4a8b-ac49-cfb98ad01b47

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1021.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e8d5e9f3-ec32-4a07-bdc7-86a2cff8a975

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1572

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e9f04e42-2c14-406a-9ddf-ce93f91beab7

CrowdStrike Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:S0591

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1d3f409-bd52-40fe-8d9e-67e176a6a625

Check Point Scattered Spider JUL 2025 · Mandiant UNC3944 May 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1578.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f54ce1d1-519a-417a-b2f5-6132d9690631

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9234d49-433d-41b2-ac26-7e9c899e6076

CrowdStrike Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023 · Mandiant UNC3944 May 2025

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1114

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9270fc0-7d9f-4380-bf78-1f79fa775455

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f93c2e91-ab53-454b-a54d-085a5a3c5e80

Check Point Scattered Spider JUL 2025 · Mandiant UNC3944 May 2025

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.