Skip to content
Start with Identity
Join free
Threat actor · Extortion group · MITRE ATT&CK G1015

Scattered Spider identity breaches

Scattered Spider is a native English-speaking cybercriminal group that MITRE ATT&CK tracks as G1015 and describes as active since at least 2022. Google Threat Intelligence tracks overlapping activity as UNC3944, and MITRE lists Roasted 0ktapus, Octo Tempest and Storm-0875 as associated names. MITRE says the group relies on social engineering, including impersonating IT and help desk staff, to gain initial access and bypass MFA, and has used that to reach administrator access in Okta, AWS and Office 365. Google reports the group began with telecom-focused SIM swap operations and moved to ransomware and data theft extortion in early 2023. Public reporting links Scattered Spider-style tactics to the 2025 UK retail attacks involving DragonForce ransomware; Google says it has not independently confirmed that link, so the Marks and Spencer record here is a reported link, not a confirmed attribution.

Also tracked as
UNC3944, 0ktapus, Roasted 0ktapus, Scatter Swine, Octo Tempest, Storm-0875
Origin (as attributed)
Native English-speaking cybercriminal group (MITRE ATT&CK); no state attribution
MITRE ATT&CK
G1015
Profile verified
Nov 5, 2026
8
incidents in the database, disclosed 2022-2025
3 / 0
MFA bypassed / not enforced (5 not applicable or undisclosed)
50%
began with help desk social engineering
8 / 0
human / non-human identity abused

Incidents attributed to Scattered Spider

Records whose sources attribute the intrusion to this group or one of its tracked names, newest disclosure first. Each record links its primary sources.

Browse the full database

Identity techniques used

Identity controls that failed

How to defend against Scattered Spider

One control per initial access vector seen in this group's records, most frequent first. The identity lesson on each incident page gives the case-specific detail.

  1. Help desk social engineering (4 of 8): Require positive identity verification before any help desk password or MFA reset, with an out-of-band callback to a number already on file, and stricter checks for privileged accounts. See Help desk social engineering, Account recovery and Vishing.
  2. Credential phishing (2 of 8): Replace phishable factors (SMS, voice, OTP codes) with phishing-resistant MFA so a captured password and code cannot be replayed. See Phishing-resistant MFA, Passkeys and OTP relay.
  3. Third-party access (2 of 8): Give vendors and outsourced support only the access they need, for as long as they need it, and review delegated administrative rights regularly. See Least privilege, Just-in-time access and PAM.

Sources

  1. Scattered Spider, Group G1015
  2. Defending Against UNC3944: Cybercrime Hardening Guidance from the Frontlines (Google Threat Intelligence and Mandiant, 2025-05-06)
  3. Roasting 0ktapus: The phishing campaign going after Okta identity credentials (Group-IB)
  4. Detecting Scatter Swine: Insights into a Relentless Phishing Campaign (Okta)

Profile verified Nov 5, 2026 against the sources above. Incident attributions come from each record's own sources. Corrections: contact us.

Frequently asked questions

Which breaches has Scattered Spider been linked to?
The Identity Breach Database attributes 8 identity breaches disclosed 2022-2025 to Scattered Spider: Marks & Spencer ransomware attack via impersonation of a third-party user (2025), Caesars Entertainment loyalty database theft via IT support vendor (2023), MGM Resorts help desk social engineering and ransomware (2023), Clorox intrusion after outsourced help desk reset passwords and MFA (2023), 0ktapus SMS phishing campaign against Okta users (2022), DoorDash data access via phished third-party vendor credentials (2022), Signal account re-registration via Twilio support console (2022) and Twilio breach via SMS phishing of employees (2022). Attribution follows each record's sources; where the actor name is only claimed, the record says so.
How does Scattered Spider get initial access?
Across its 8 records, the initial access vectors were help desk social engineering (4), credential phishing (2) and third-party access (2). The identity control that failed most often was identity lifecycle (4 of 8).
Did MFA stop Scattered Spider?
In 3 of 8 incidents MFA was present and bypassed, and in 0 it was not enforced on the abused account. In the remaining 5, MFA was not applicable (no interactive login, such as a stolen key or token) or its status was not disclosed. Every incident abused a human account.

Cite this page

SWI Community Team. (2026). Scattered Spider identity breaches. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/actors/scattered-spider/

Part of the Identity Breach Database, free to reuse under CC BY 4.0. See all threat actors.