Netskope Threat Coverage: Scattered Spider

The adversary group commonly referred to as Scattered Spider is also tracked as UNC3944, Muddled Libra, Octo Tempest, Starfraud, Scatter Swine, 0ktapus, Roasted 0ktapus, and Storm-0875. Active since at least 2022, this financially motivated group has rapidly gained notoriety for its social engineering campaigns and ransomware attacks, which span multiple sectors. Initially focused on telecom companies, they now target the hospitality, retail, critical infrastructure, technology, finance, gaming, and healthcare sectors. 

TTPS

The group is known for sophisticated social engineering campaigns, including:

• Phishing and smishing, especially mimicking Okta and other SSO services.
• Vishing, calling IT support staff posing as employees to achieve password resets or MFA removals.
• MFA fatigue, repeatedly sending MFA notifications to victims.
• SIM Swapping to hijack victims’ phone numbers to intercept MFA codes and OTPs.

Post-compromise, they use legitimate remote management tools like AnyDesk and TeamViewer to maintain persistence on compromised hosts and reset passwords and MFA enrollments to maintain persistence in compromised accounts. They use standard techniques, like enumerating AD to identify high-value targets for ransom and extortion. They also target cloud environments, like AWS and Azure, and SaaS apps like SharePoint, OneDrive, Slack, and Teams. They have deployed various ransomware families, including BlackCat, Qilin, and RansomHub. They are now using the DragonForce ransomware and developing a new Specter RAT version.

Recommendations for Netskope customers

• Train helpdesk staff to recognize standard social engineering techniques and implement strict verification protocols that do not rely on publicly available information, and train all employees to identify common tactics, including phishing, smishing, vishing, and MFA fatigue.
• With Netskope SWG, CASB Inline, and CASB API:
  • Use Netskope Advanced Threat Protection and Remote Browser Isolation to prevent phishing attacks, malware downloads, and command and control traffic.
  • Use Netskope Advanced UEBA to identify users with compromised devices (especially ones where remote access software has been installed and is being used for reconnaissance, lateral movement, exfiltration, or malware deployment) and compromised accounts (especially accounts where attackers are performing reconnaissance or stealing data).

Enable Netskope’s new advanced C2 detection capabilities that leverage behavioral analysis, heuristics, and anomaly detection to identify sophisticated C2 communication patterns, including those from custom C2 channels hidden within legitimate traffic.