Scattered Spider (UNC3944, Scatter Swine, Muddled Libra) is a financially motivated threat actor active since May 2022, primarily targeting telecom and BPO sectors and expanding to critical infrastructure. The group relies on social engineering, signed kernel drivers, and cloud-environment reconnaissance to gain access, evade detection, and exfiltrate data across victims and services. #ScatteredSpider #UNC3944
Keypoints
- Scattered Spider (aka UNC3944, Scatter Swine, Muddled Libra) has historically targeted telecoms and BPOs, now broadening to other sectors including critical infrastructure.
- It employs social engineering (Telegram/SMS phishing), MFA fatigue tactics, SIM swapping, and impersonation of IT personnel to obtain credentials or remote access.
- Tools such as POORTRY and STONESTOP are used to terminate security software; the attackers sign malware with Authenticode to appear legitimate.
- Exploits CVE-2015-2291 (Intel Ethernet driver) and CVE-2021-35464 (ForgeRock AM) to deploy kernel drivers and elevate privileges.
- The group conducts environment reconnaissance across Windows/Linux/Google Workspace/Azure/Microsoft 365/AWS and uses legitimate remote access tools (AnyDesk, LogMeIn, ConnectWise Control) for persistence and lateral movement.
- Notable incidents include December 2022 telecom/BPO campaigns, August 2022 Twilio data exposure affecting Okta, and April 2023 POORTRY usage against NCR.
- MITRE ATT&CK mappings and a broad IOC profile illustrate detection and prevention opportunities across both traditional and mobile attack surfaces.
MITRE Techniques
- [T1566] Phishing – Social engineering via phone calls and text messages impersonating IT personnel to obtain credentials or direct victims to credential harvesting or RMM tools. ‘Initial access was via social engineering using phone calls and text messages to impersonate IT personnel, and either directing victims to a credential harvesting site or directing victims to run commercial Remote Monitoring and Management (RMM) tools.’
- [T1021.001] Remote Services – Use legitimate remote access tools (AnyDesk, LogMeIn, ConnectWise Control) to establish persistence and enable lateral movement. ‘establish persistence through legitimate remote access tools such as AnyDesk, LogMeIn, and ConnectWise Control.’
- [T1068] Exploitation for Privilege Escalation – CVE-2015-2291 exploited to deploy a malicious kernel driver. ‘exploited CVE-2015-2291 which is a vulnerability … to deploy a malicious kernel driver.’
- [T1134.001] Access Token Manipulation: Token Impersonation/Theft – Requesting and assuming permissions of an instance role using a compromised AWS token. ‘requesting and assuming the permissions of an instance role using a compromised AWS token.’
- [T1553.002] Subvert Trust Controls: Code Signing – Attestation signing to sign malware. ‘attestation signing to sign malware’
- [T1036] Masquerading – Signed POORTRY driver with Authenticode signature to masquerade as legitimate software. ‘signed POORTRY driver with a Microsoft Windows Hardware Compatibility Authenticode signature.’
- [T1041] Exfiltration Over C2 Channel – Data exfiltration over command-and-control channels. ‘Exfiltration Over C2 Channel’
- [T1195.002] Compromise Software Supply Chain – Attested/signed drivers used to aid post-exploitation.
- [T1616] Call Control – MITRE Mobile mapping indicates collection via Call Control. ‘COLLECTION’ → ‘T1616: Call Control’
- [T1451] Sim Card Swap – MITRE Mobile mapping indicates SIM card swapping as a collection method. ‘COLLECTION’ → ‘T1451: Sim Card Swap’
Indicators of Compromise
- [IPv4] Adversary remote access – 100.35.70.106, 104.247.82.11
- [IPv4] Adversary remote access – 105.101.56.49, 105.158.12.236
- [IPv4] IP associated with data exfil – 144.76.136.153, 45.134.140.171
- [IPv6] IPv6 associated with transfer.sh used for data exfiltration – 2a01:4f8:200:1097::2
- [CIDR] IPv6/CIDR context related to transfer.sh – 2a01:4f8:200:1097::2
- [SHA256] Packed Fleet Deck binary – 3ea2d190879c8933363b222c686009b81ba8af9eb6ae3696d2f420e187467f08
- [SHA256] IIatZ Backconnect TCP malware – cce5e2ccb9836e780c6aa075ef8c0aeb8fec61f21bbef9e01bdee025d2892005
- [SHA256] insomnia.exe (API debugging utility) – acadf15ec363fe3cc373091cbe879e64f935139363a8e8df18fd9e59317cc918