2023-11-16 · day precision · report
Joint advisory: Scattered Spider (subsequently revised; inspect source)
Dated public source. This cell records publication, not the start of an attack.
· Source-attributed report · source published 2023-11-16
Scattered Spider
No sourced public emblem in this profile.
research profile · reported nexus: Unknown (not nationality)
Scattered Spider, a highly active hacking group, has made headlines by targeting more than 130 organizations, with the number of victims steadily increasing.
Source-reported aliases: UNC3944, Muddled Libra, Oktapus, Scattered Swine, Scatter Swine, Octo Tempest, 0ktapus, Storm-0971, DEV-0971, Starfraud. Associations do not prove equivalence.
Kinwilder analysis
A support or recovery workflow can be an authorization interface. Evaluate help-desk identity checks, session revocation and account recovery with the same care as a login screen. Keep the activity cluster separate from claims about an individual or a changing affiliate roster.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
https://www.loginradius.com/blog/identity/oktapus-phishing-targets-okta-identity-credentials/
https://www.attackiq.com/2023/11/21/attack-graph-response-to-cisa-advisory-aa23-320a/
https://www.mandiant.com/resources/blog/unc3944-sms-phishing-sim-swapping-ransomware