Scattered Spider

Overview

Scattered Spider is a loosely organized, financially motivated cybercrime group made up largely of young English-speaking members (linked to the broader online "Com"). It is tracked by security firms as UNC3944, 0ktapus, Scatter Swine, Octo Tempest, Muddled Libra, and Starfraud. It specializes in phone-based social engineering, SMS phishing ("smishing"), help-desk impersonation, MFA-fatigue bombing, and SIM-swapping to bypass multi-factor authentication. ^[1][2]

Tactics

Members trick employees or telecom staff into surrendering credentials or porting a victim's phone number to a SIM the attackers control, letting them intercept one-time passcodes and password-reset links. They have used this to breach corporate networks and, separately, to drain individuals' crypto accounts and self-custody wallets (e.g. by capturing seed phrases or 2FA codes). The group later expanded into ransomware/extortion against large enterprises. ^[1][2]

Crypto theft and prosecutions

In a 2022 smishing spree, the group breached firms including Twilio, LastPass, DoorDash, and Mailchimp and used that access against downstream targets; prosecutors say members "mainly sought to steal cryptocurrency." The U.S. charged several alleged members in 2024. Noah Urban ("Kingbob"/"Sosa") was sentenced to 10 years and ~$13M restitution; Tyler Buchanan ("Tylerb"), extradited from Spain, pleaded guilty and admitted stealing at least $8 million in crypto from individuals. Others, including Remington Ogletree ("remi"), were also charged. ^[1][2]

Bracketed numbers refer to the numbered sources listed below.