Edit: Scattered Spider — CryptoScamsWiki

Title / name *

Summary *

Category *

Scam type *

Severity *

Chain

Token

Amount lost (USD)

Image

Upload

Paste a link or upload a file (max 5 MB).

Details (Markdown supported)

## Overview

Scattered Spider is a loosely organized, financially motivated cybercrime group made up largely of young English-speaking members (linked to the broader online "Com"). It is tracked by security firms as UNC3944, 0ktapus, Scatter Swine, Octo Tempest, Muddled Libra, and Starfraud. It specializes in phone-based social engineering, SMS phishing ("smishing"), help-desk impersonation, MFA-fatigue bombing, and SIM-swapping to bypass multi-factor authentication. [1][2]

## Tactics

Members trick employees or telecom staff into surrendering credentials or porting a victim's phone number to a SIM the attackers control, letting them intercept one-time passcodes and password-reset links. They have used this to breach corporate networks and, separately, to drain individuals' crypto accounts and self-custody wallets (e.g. by capturing seed phrases or 2FA codes). The group later expanded into ransomware/extortion against large enterprises. [1][2]

## Crypto theft and prosecutions

In a 2022 smishing spree, the group breached firms including Twilio, LastPass, DoorDash, and Mailchimp and used that access against downstream targets; prosecutors say members "mainly sought to steal cryptocurrency." The U.S. charged several alleged members in 2024. Noah Urban ("Kingbob"/"Sosa") was sentenced to 10 years and ~$13M restitution; Tyler Buchanan ("Tylerb"), extradited from Spain, pleaded guilty and admitted stealing at least $8 million in crypto from individuals. Others, including Remington Ogletree ("remi"), were also charged. [1][2]

_Bracketed numbers refer to the numbered sources listed below._

Aliases (one per line)

Wallets (chain:address per line)

Propose an edit