emulation-scattered-spider

name: emulation-scattered-spider description: "Scattered Spider (UNC3944 / Octo Tempest) adversary-emulation playbook — help-desk vishing → MFA takeover → cloud/SaaS/identity privilege expansion → RMM persistence → data-theft extortion. Use when emulating identity-first social-engineering eCrime against a help-desk/IdP estate. Triggers on: 'emulate Scattered Spider', 'UNC3944', 'Octo Tempest', '0ktapus', 'help desk social engineering', 'MFA fatigue', 'SIM swap', 'identity attack'." allowed-tools: Read Write Edit metadata: subdomain: planning when_to_use: "emulate Scattered Spider, UNC3944, Octo Tempest, Muddled Libra, Roasted 0ktapus, help desk social engineering, vishing, MFA fatigue, SIM swap, Okta abuse, cloud identity takeover, RMM persistence, ransomware affiliate" tags: adversary-emulation, scattered-spider, unc3944, social-engineering, identity, ecrime mitre_attack: T1656, T1598, T1621, T1078.004, T1219, T1486

Scattered Spider — Adversary Emulation Playbook

Tier-2 native-English-speaking eCrime collective. Their edge is social engineering: impersonating employees to the IT help desk to drive password resets and MFA transfers, then pivoting fast through the identity provider (Okta / Entra ID) into cloud and SaaS, deploying legitimate RMM for persistence, and finishing with data-theft extortion / ransomware. Authorized red-team emulation only — every action runs under the engagement RoE.

When to emulate Scattered Spider

• The client wants their human + identity perimeter tested: help-desk verification process, IdP admin controls, MFA resilience, RMM allow-listing.
• Telecom, BPO/CRM, technology, gaming, hospitality, retail, financial, or MSP targets.
• The scenario is fast and brazen extortion — the opposite of APT29's low-and-slow.

ThreatProfile seed (plan/threat-profile.json)

{
  "engagement_name": "<fill>",
  "actor_name": "Scattered Spider-like (UNC3944 / Octo Tempest)",
  "actor_aliases": ["UNC3944", "Octo Tempest", "Muddled Libra", "Roasted 0ktapus", "Scatter Swine"],
  "group_id": "G1015",
  "tier": "tier-2",
  "sophistication": "high",
  "motivation": "financial",
  "initial_access": ["T1656", "T1598", "T1566.004", "T1078.004"],
  "key_ttps": ["T1621", "T1556.006", "T1098.005", "T1078.004", "T1219", "T1213", "T1486", "T1657"],
  "tools": ["Authorized test persona (vishing)", "AnyDesk / ConnectWise (engagement-owned)", "Sliver", "NetExec", "Impacket"],
  "infrastructure": ["Spoofed/marked caller-ID test line", "Look-alike SSO phishing page", "Attacker-registered MFA device (engagement-controlled)", "Rogue VM in victim vSphere/Azure"],
  "recent_cti_delta": "2023-2025: help-desk impersonation + MFA fatigue + SIM swap; registers its own MFA, creates rogue VMs in vSphere/Azure; pivoted to impersonating employees against third-party IT; ransomware affiliate ALPHV -> RansomHub -> DragonForce.",
  "confidence": "probable"
}

Kill-chain emulation

CONOPS kill_chain (copy into conops.json)

1. recon — OSINT/PII + help-desk reset-process recon (1).
2. initial-access — vishing → password reset + MFA takeover → cloud login (2-4).
3. post-exploit — Okta/IAM scope expansion, RMM persistence, optional on-prem AD pivot, SaaS collection (5-8).
4. c2 — Sliver / RMM session (within row 6).
5. exfiltration — data theft → extortion demonstration on canary (9-10).

OPSEC & signature fidelity

• Brazen, not stealthy. Scattered Spider moves in minutes-to-hours and leans on legitimate identity + RMM, so the detection signature is behavioral: a help-desk reset anomaly, a new MFA device, an unexpected RMM install, a new VM. Mirror that pattern so the blue team's detections are exercised.
• Live off the victim's own tooling (vSphere, Azure portal) to create infrastructure.
• Persistence = own MFA token + RMM, not malware implants.

RoE / safety gates

• Social engineering of real staff/help desk requires explicit, written authorization plus HR/legal sign-off and a lure-deconfliction pass (/skills/standard/phisher/lure-deconfliction/SKILL.md). Name exactly which staff/roles are in scope.
• No real SIM swaps against personal numbers (illegal). Simulate the SIM-swap effect with an authorized engagement-controlled test number only.
• Ransomware/financial-theft impact is canary-only; add an EMERGENCY abort trigger: "real customer data exfiltrated, real funds moved, or production system encrypted."

Deconfliction

• Brief a single deconfliction POC (NOT the help desk under test) and use a marked test persona + caller-ID so the activity can be separated from a real Octo Tempest call post-hoc.
• Record the attacker-registered MFA device, RMM install IDs, and any rogue VM in deconfliction.json + cleanup.json.
• Time-box vishing windows; never call outside the agreed hours.

Fidelity notes (deviations)

• The vishing is performed by an authorized tester against a scoped help desk; the point is to measure the reset/verification process, not to deceive arbitrary staff.
• MFA registration uses an engagement-controlled device; RMM is an engagement-owned AnyDesk/ConnectWise tenant.
• Impact is a canary marker proving the access would allow encryption/theft — never a real locker.