Scattered Spider
ObscureIQ Threat Intelligence · Actor Profile
Scattered SpiderConfidence: High
Collective / brand
Also known as: Muddled Libra, Oktapus, Scattered Lapsus$ Hunters, UNC3944
Motivation: Financial; Reputational harm to target
1Attributed Breaches Circulating
HighAttribution Confidence
Collective / brandActor Type
Part of the Scattered Lapsus$ Hunters coalition (41 combined breaches). Coalition breaches are tracked once on the coalition profile and cross-referenced here.
Overview
Notorious for the 2023 MGM and Caesars casino intrusions, a decentralized US/UK cybercrime collective of independent clusters specializing in social engineering to steal credentials and bypass MFA. Coordinates with LAPSUS$ and ShinyHunters under the Scattered Lapsus$ Hunters brand; signature TTPs include help-desk vishing, SIM swapping, MFA fatigue, and phishing kits.
Tactics, Targeting & TTPs
TTPs: help-desk vishing, SIM swapping, MFA fatigue, phishing kits. Overlaps and coordinates with LAPSUS$ and ShinyHunters under the Scattered Lapsus$ Hunters brand; a member was arrested and extradited to the US.
Related Clusters & Actors
LAPSUS$ShinyHuntersScattered Lapsus$ Hunters
Source
Attribution draws on public threat-intelligence reporting · Established (multi-source). Primary source →
Were you exposed in one of these breaches?
Check your exposure privately, or request a tailored exposure audit.