Scattered Spider
Scattered Spider is a Canada-attributed ransomware group with a financial motive, tracked by Brandefense. It targets 17 sectors, including Government and Technology, in 29 countries, including the United States and the United Kingdom. It uses 209 MITRE ATT&CK techniques and exploits 18 known CVEs.
Also known as
- Roasted 0ktapus
- Octo Tempest
- Storm-0875
- UNC3944
- 0ktapus
- Scatter Swine
- Origin
- Canada
- Techniques
- 209
- Exploited CVEs
- 18
- First seen
- Aug 21, 2025
- Last seen
- Dec 16, 2025
- Record updated
Who They Target.
Sectors · 17
Countries · 29
Labelscredential-theftdata-extortionglobalidentity-attackidentity-based attacksmfa bypassransomwaresaas-compromisesalesforcesocial-engineeringvishing
About Scattered Spider.
A threat group with shared tactics with UNC6040, but with different objectives, aiming for broader network access.
Last updated Sep 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.