Emulating the Unyielding Scattered Spider – Source: securityboulevard.com

Scattered Spider, also known as 0ktapus, Starfraud, UNC3944, Scatter Swine, Octo Tempest, and Muddled Libra, is a financially motivated cybercriminal group active since at least mid-2022. They primarily target large enterprises across multiple industries such as telecommunications, technology, finance, and retail. The group is known for sophisticated social engineering tactics, often impersonating IT staff to gain initial access and conducting multi-factor authentication (MFA) fatigue attacks or SIM swap operations.

Once inside a network, Scattered Spider leverages a mix of Remote Management Tools, Living Off the Land Binaries (LOLBins), tools like Mimikatz and Impacket, and malware such as stealers, Remote Access Trojans (RATs), and ransomware. The group has been linked to ransomware operations including ALPHV/BlackCat and DragonForce, for which AttackIQ has developed in-depth emulation content.

The group was attributed the September 2023 breach of MGM Resorts International, where they disrupted operations and caused major financial damage. While not yet officially confirmed, Scattered Spider is suspected to be behind recent attacks targeting Marks & Spencer, Co-Op, and Harrods.

Their operations demonstrate a high level of coordination, adaptability, and technical skill, making them a serious threat to organizations with inadequate or inconsistent security defenses. To help defenders improve detection and response, AttackIQ offers a curated list of emulations for malware families associated with Scattered Spider:

DragonForce Ransomware

• DragonForce Ransomware – 2023-09 – From Public-Facing Remote Desktop Server to Domain-wide Ransomware Deployment
• [Malware Emulation] DragonForce Ransomware – 2025-05 – Associated Tactics, Techniques and Procedures (TTPs)

Reference: https://www.attackiq.com/2025/05/23/emulating-dragonforce-ransomware/

BlackCat / ALPHV Ransomware

• [CISA AA23-353A] #StopRansomware: ALPHV Blackcat
• [Malware Emulation] 2023-12 ALPHV/BlackCat Ransomware

Reference: https://www.attackiq.com/2024/03/07/emulating-alphv-blackcat/

Lumma Stealer

• Lumma Stealer – 2024-09 – Associated Tactics, Techniques and Procedures (TTPs)

Reference: https://www.attackiq.com/2025/05/22/response-to-cisa-advisory-aa25-141b/

AttackIQ has previously released an assessment template in response to the CISA Advisory (AA23-320A) that emulates the observed capabilities of Scattered Spider detailed in the advisory. In addition, AttackIQ has now released an assessment template with the known tooling and malware samples associated with the group.

Validating your security program performance against these behaviors is vital in reducing risk. By using this new assessment template in the AttackIQ Security Optimization Platform, security teams will be able to:

• Evaluate security control performance against tools and malware samples associated with Scattered Spider.
• Assess their security posture against an evolving and persistent threat.
• Continuously validate detection and prevention pipelines against a wide range of samples.

Scattered Spider – 2025-05 – Associated Samples and Techniques

This assessment template compiles a curated set of tools, malware families, and techniques observed in Scattered Spider’s operations over the past few years.

The assessment is divided into three individual tests: Malware Samples, Scripts and Tools, and Techniques.

1. Malware Samples

This section contains Malware Families associated with Scattered Spider, including:

• Ransomware families: BlackCat and DragonForce
• Stealers: Atomic Stealer, Lumma Stealer, Vidar Stealer, AveMaria Stealer and Raccoon Stealer
• Remote Access Trojans: RattyRAT, SpectreRAT and Sorrilus RAT
• Others: STONESTOP and POORTRY

2. Scripts and Tools

This section contains scripts and tools used by Scattered Spider to accomplish different goals:

• Lateral Movement: Impacket wmiexec.py
• Credential Access: Mimikatz, Lazagne, secretsdump.py, gosecretsdump and SecretServerSecretStealer
• Discovery: ADRecon, RustScan, TruffleHog and AdvancedIPScanner
• Command and Control: Rsocx

3. Techniques

This section contains techniques associated with the tools in section 2.

Dump Passwords using LaZagne: This scenario uses the open-source tool LaZagne to dump all possible credentials available on the host.

Dump Windows Passwords with Obfuscated Mimikatz: This scenario utilizes an obfuscated version of Mimikatz to dump passwords and hashes for Windows accounts.

Wrap Up

In summary, this assessment template will evaluate security and incident response processes and support the improvement of your security control posture against the behaviors exhibited by Scattered Spider. With data generated from continuous testing and use of this assessment template, you can focus your teams on achieving key security outcomes, adjust your security controls, and work to elevate your total security program effectiveness against a known and dangerous threat.

AttackIQ, the leading provider of Adversarial Exposure Validation (AEV) solutions, is trusted by top organizations worldwide to validate security controls in real time. By emulating real-world adversary behavior, AttackIQ closes the gap between knowing about a vulnerability and understanding its true risk. AttackIQ’s AEV platform aligns with the Continuous Threat Exposure Management (CTEM) framework, enabling a structured, risk-based approach to ongoing security assessment and improvement. The company is committed to supporting its MSSP partners with a Flexible Preactive Partner Program that provides turn-key solutions, empowering them to elevate client security. AttackIQ is passionate about giving back to the cybersecurity community through its free award-winning AttackIQ Academy and founding research partnership with MITRE Center for Threat-Informed Defense.