PRIMARY SOURCE DB
MITRE ATT&CK v15.1
Page built 2026-11-12
Data as of November 12, 2026 at 05:15 UTC
Search
MITRE ATT&CK G1015

Scattered Spider / UNC5537

View MITRE Group Page ↗
Aliases: UNC3944, Octo Tempest, Muddled Libra, Starfrost
Official Attribution Source: CISA & FBI Joint Advisory AA23-320A and Mandiant UNC5537 Report

Key Facts

Jurisdiction
Transnational (US / UK / Canada)
Geographic origin
Cases
3
Prosecution matters
Defendants
0
Indicted individuals
Sanctions
0
OFAC designations
  • Attributed Country: Transnational (US / UK / Canada).
  • ATT&CK Group Reference: G1015 (Scattered Spider / UNC5537).
  • Linked to 3 primary court prosecution record(s) with $605.0 million documented loss.
  • Identified 0 individually charged operative(s) and 0 OFAC designation(s).

Primary ATT&CK Techniques Employed

ATT&CK Techniques Mapped to Scattered Spider / UNC5537 Technique frequencies extracted from verified indictments for Scattered Spider / UNC5537. T1078 Valid Accounts 1 incidents T1110 Brute Force 1 incidents T1567 Exfiltration Over Web Service 1 incidents T1041 Exfiltration Over C2 Channel 1 incidents
Technique frequencies extracted from verified indictments for Scattered Spider / UNC5537.
ATT&CK Techniques Mapped to Scattered Spider / UNC5537
Technique Frequency
T1078 Valid Accounts 1 incidents
T1110 Brute Force 1 incidents
T1567 Exfiltration Over Web Service 1 incidents
T1041 Exfiltration Over C2 Channel 1 incidents

Prosecution Cases Attributed to Scattered Spider / UNC5537

Snowflake Enterprise Credential Stuffing & Customer Cloud Thefts

alleged 2024-05-23

Financially motivated threat actor collective UNC5537 systematically infiltrated over 165 corporate customer tenants hosted on Snowflake (including Ticketmaster, Santander Bank, Advance Auto Parts, and LendingTree). Attackers leveraged infostealer malware logs dating back years against enterprise user accounts that lacked multi-factor authentication and IP network allowlists, exfiltrating billions of consumer records.

Primary Attack Mechanism: UNC5537 threat actors leveraged historical infostealer malware logs (RedLine, Vidar, Lumma) capturing username and password combinations for contractor accounts. Crucially, the target Snowflake customer accounts lacked multi-factor authentication and network IP allowlisting.
4 techniques mapped · Loss: $500.0 million View full case dossier →

AT&T Cloud Telecom Call and Text Metadata Exfiltration

investigation 2024-07-12

Illegal exfiltration of call and text interaction metadata spanning six months for approximately 110 million AT&T wireless customers. Intrusion stemmed from an illicit access point to a third-party Snowflake cloud environment, leading to a 5.7 Bitcoin extortion fee paid through an intermediary to obtain verified video evidence of dataset deletion.

Primary Attack Mechanism: Threat actors accessed an AT&T corporate workspace hosted on Snowflake using compromised credentials that lacked hardware multi-factor authentication.
2 techniques mapped · Loss: $100.0 million View full case dossier →

FTC v. Global Tel*Link Corp. (Correctional S3 Bucket Leak)

settled 2024-01-16

Landmark Federal Trade Commission enforcement action against major correctional telecommunications vendor Global Tel*Link (GTL) for reckless data security practices that left an unencrypted Amazon S3 cloud repository containing 650,000 personal and biometric records exposed to the public internet for months.

Primary Attack Mechanism: Initial access established against Telecommunications & Government Contracting infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Landmark Federal Trade Commission enforcement action against major correctional telecommunications vendor Global Tel*Link (GTL) for reckless data security practices that left an unencrypted Amazon S3 cloud repository containing 650,000 personal and biometric records exposed to the public internet for months.
2 techniques mapped · Loss: $5.0 million View full case dossier →

Documented TTP Signature for Scattered Spider / UNC5537

Test Controls in Stack Audit →
T1078: Valid Accounts

Adversaries obtain and misuse legitimate credentials of existing user accounts to maintain persistence and bypass controls.
T1110: Brute Force

Adversaries use automated credential guessing or password spraying against authentication portals.
T1567: Exfiltration Over Web Service

Adversaries exfiltrate sensitive files to legitimate cloud storage providers like Mega or Google Drive.
T1041: Exfiltration Over C2 Channel

Adversaries transmit stolen data over existing command and control channels back to adversary servers.