Quick links
Press Enter to search, Esc to close
Threat group profile
Scattered Spider is described by MITRE ATT&CK and by the FBI, CISA and partner agencies as a cybercriminal group that targets large companies and their IT help desks, mainly by tricking staff into resetting passwords and MFA.
In short
Scattered Spider is described by MITRE ATT&CK and by the FBI, CISA and partner agencies as a cybercriminal group that targets large companies and their IT help desks, mainly by tricking staff into resetting passwords and MFA. The UK National Crime Agency said on 16 July 2026 that its action against two leading members effectively halted the group, while others may reuse the name.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| Scattered Spider | MITRE ATT&CK G1015; joint advisory AA23-320A; US Department of Justice[1, 2, 9] |
| Roasted 0ktapus | MITRE ATT&CK Associated Groups[1] |
| Octo Tempest | MITRE ATT&CK Associated Groups; AA23-320A; US Department of Justice[1, 2, 9] |
| Storm-0875 | MITRE ATT&CK Associated Groups; AA23-320A[1, 2] |
| UNC3944 | MITRE ATT&CK Associated Groups; AA23-320A; US Department of Justice[1, 2, 9] |
| Scatter Swine | Joint advisory AA23-320A[2] |
| Oktapus | Joint advisory AA23-320A[2] |
| 0ktapus | US Department of Justice complaints, 2025 and 2026[9, 10] |
| Muddled Libra | Joint advisory AA23-320A[2] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK Page version 3.0, last modified 31 July 2026
Describes the group as a native English-speaking cybercriminal group active since at least 2022, and lists Roasted 0ktapus, Octo Tempest, Storm-0875 and UNC3944 as associated groups.[1]
CISA and FBI with RCMP, ASD's ACSC, AFP, Canadian Cyber Centre and UK NCSC 16 November 2023, updated 29 July 2025
Joint advisory says Scattered Spider is a cybercriminal group that targets large companies and their contracted IT help desks, using FBI investigation data as recent as June 2025.[2, 3]
Canadian Centre for Cyber Security 29 July 2025
Repeats the joint advisory and describes the group as a cyber criminal group that targets large organizations and their contracted IT help desks.[4]
UK National Cyber Security Centre 4 May 2025
Said it was not yet in a position to say whether the retail attacks were linked or were a campaign by a single actor. It noted press speculation about the group and advised on help desk checks.[5]
UK National Crime Agency 10 July 2025
Arrested four people over attacks on M&S, Co-op and Harrods in April 2025. Its page does not name Scattered Spider and states no charge.[6]
US Department of Justice 18 September 2025
A complaint (District of New Jersey) alleges that Thalha Jubair took part in an extortion scheme "carried out by a group known as Scattered Spider". A complaint is an allegation.[9]
UK National Crime Agency 22 June 2026
Stated that Thalha Jubair and Owen Flowers were members of the group known as Scattered Spider and had changed their pleas to guilty over the Transport for London attack.[7]
UK National Crime Agency 16 July 2026
Stated that the two were leading members, were each sentenced to five years and six months, and that its action effectively halted the group's criminal activity, though others may reuse the name.[8]
US Department of Justice 1 July 2026
A complaint (Northern District of Illinois) charges Peter Stokes with conspiracy, computer intrusion and fraud and calls him an alleged member of Scattered Spider. A complaint is an allegation.[10]
Sources differ on what the name covers. The US Department of Justice (18 September 2025 and 1 July 2026) and MITRE describe a long-running group. The UK National Crime Agency (16 July 2026) says its action against two leading members effectively halted the group, while saying others may keep using the name. The UK NCSC (4 May 2025) and the National Crime Agency (10 July 2025) did not tie the April 2025 retail attacks to Scattered Spider, so those attacks are not counted here as the group's work. Court papers give the nationalities of people charged (United Kingdom; United States and Estonia). No source gives a country of origin for the group itself.
Each entry is attributed to the group by the sources cited.
MITRE lists campaign C0027 with these dates, using SMS and phone calls that pose as IT staff, MFA push requests and remote access tools.[1]
A US complaint alleges the intrusions it describes ran from as early as May 2022 to as recently as September 2025. These are allegations.[9]
The NCA says Owen Flowers was first arrested for the TfL attack and was found to be hacking the systems of two US healthcare companies.[8]
A US complaint alleges Thalha Jubair took part in access to a US critical infrastructure company and the US Courts. An allegation only.[9]
The NCSC says it cannot yet say whether the UK retail attacks are linked, and notes press speculation about the group.[5]
A US complaint alleges a ransom demand of about $8 million to a jewellery retailer; the retailer evicted the intruders and no ransom was paid. An allegation only.[10]
The updated advisory uses FBI investigation data as recent as June 2025.[2]
The Department of Justice unseals a complaint against Thalha Jubair.[9]
The Department of Justice says Finnish authorities arrested Peter Stokes in April under an Interpol Red Notice.[10]
The NCA says Jubair and Flowers changed their pleas to guilty over the TfL attack.[7]
The Department of Justice says Stokes was extradited and made an initial appearance in Chicago. An allegation only.[10]
The NCA says Jubair and Flowers were each sentenced to five years and six months.[8]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 16 Nov 2023 | CISA and FBI | Joint advisoryRelease of advisory AA23-320A on Scattered Spider, with tactics and mitigations.[2, 3] |
| 4 May 2025 | UK NCSC | Advice to organizationsBlog post with recommendations after the retail attacks, with a link to the joint advisory.[5] |
| 10 Jul 2025 | UK National Crime Agency | ArrestsFour people arrested over the M&S, Co-op and Harrods attacks; the page does not name Scattered Spider and states no charge.[6] |
| 29 Jul 2025 | FBI, CISA, RCMP, ASD's ACSC, AFP, Canadian Cyber Centre, UK NCSC | Updated joint advisoryNew methods, tools and ransomware added; the Canadian Cyber Centre republished it.[2, 4] |
| 16 Sep 2025 | UK National Crime Agency and City of London Police | ArrestsThalha Jubair and Owen Flowers arrested at their home addresses.[8, 9] |
| 18 Sep 2025 | US Department of Justice | Criminal complaintComplaint (District of New Jersey) against Thalha Jubair for conspiracies to commit computer fraud, wire fraud and money laundering. An allegation, not a conviction.[9] |
| April 2026 | Finnish authorities for the US | ArrestPeter Stokes arrested in Finland under an Interpol Red Notice.[10] |
| 22 Jun 2026 | UK court, as reported by the NCA | Guilty pleasJubair and Flowers changed their pleas to guilty over the Transport for London attack.[7] |
| 1 Jul 2026 | US Department of Justice | Criminal complaint and extraditionComplaint (Northern District of Illinois) against Peter Stokes for conspiracy, computer intrusion and fraud; he was extradited from Finland. An allegation, not a conviction.[10] |
| 16 Jul 2026 | UK court, as reported by the NCA | SentencesJubair and Flowers each sentenced to five years and six months.[8] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Phishing: Spearphishing Voice T1566.004
Phones staff and help desks, posing as IT or as the employee, to reset passwords or move MFA to a device the caller controls.[1, 2]
Valid Accounts T1078
Uses stolen or bought employee and contractor credentials to get in.[1, 2]
SIM Card Swap T1451
Gets a mobile carrier to move a victim's number to a SIM the attacker holds, so the attacker receives MFA codes.[1, 2]
DragonForce ransomware Ransomware
The advisory says trusted third parties report it was used most recently, encrypting VMware ESXi servers.[1, 2]
BlackCat Ransomware
MITRE says the group has deployed BlackCat ransomware; CISA noted BlackCat/ALPHV in November 2023.[1, 3]
Raccoon Stealer Information stealer
Steals login credentials, browser history and cookies.[1, 2]
VIDAR Stealer Information stealer
Listed in the advisory as malware that steals credentials, browser history and cookies.[2]
WarzoneRAT Remote access trojan
Listed by MITRE; the advisory names it as AveMaria, also known as WarZone.[1, 2]
RattyRAT Remote access trojan
Java-based remote access trojan named in the July 2025 update.[2]
Mimikatz Credential theft tool
ngrok Tunnelling tool
A legitimate tool used to tunnel to local servers over the internet.[1, 2]
ConnectWise Remote monitoring tool
MITRE says the group used it to keep persistent access.[1]
Rclone Data transfer tool
Listed by MITRE among the group's software.[1]
Allowlist approved remote access programs, block portable versions and review logs for unusual use.
Counters T1219.002
Find look-alike login and help desk domains registered to copy your company, the pattern the joint advisory describes.
See whether employee or contractor credentials are offered for sale, which the advisory says this group has bought.
Check where the personal details of staff with high access are exposed, since the advisory says such details feed the phone and text tricks.
Follow ransomware families and extortion activity, such as DragonForce, that the advisory ties to this group.
No source opened names a state. MITRE ATT&CK and the joint advisory describe it as a cybercriminal group. No source gives a country of origin.
Mainly through people. The joint advisory describes phone calls and texts posing as IT or help desk staff, repeated MFA prompts and SIM swaps, and calls that persuade a help desk to reset a password or move MFA.
The advisory updated on 29 July 2025 uses FBI data as recent as June 2025. On 16 July 2026 the UK National Crime Agency said its action against two leading members effectively halted the group, while others may reuse the name.
In the UK, Thalha Jubair and Owen Flowers pleaded guilty over the Transport for London attack and were each sentenced to five years and six months on 16 July 2026, per the NCA. In the US, Jubair (18 September 2025) and Peter Stokes (1 July 2026) are charged by complaint, which is an allegation and not a conviction.
Tighten how your help desk checks who is calling before a password or MFA reset, and move to phishing-resistant MFA, per the UK NCSC and the joint advisory.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.