emulation-scattered-spider

name	emulation-scattered-spider
description	Scattered Spider (UNC3944 / Octo Tempest) adversary-emulation playbook — help-desk vishing → MFA takeover → cloud/SaaS/identity privilege expansion → RMM persistence → data-theft extortion. Use when emulating identity-first social-engineering eCrime against a help-desk/IdP estate. Triggers on: 'emulate Scattered Spider', 'UNC3944', 'Octo Tempest', '0ktapus', 'help desk social engineering', 'MFA fatigue', 'SIM swap', 'identity attack'.
allowed-tools	Read Write Edit
metadata	{"subdomain":"planning","when_to_use":"emulate Scattered Spider, UNC3944, Octo Tempest, Muddled Libra, Roasted 0ktapus, help desk social engineering, vishing, MFA fatigue, SIM swap, Okta abuse, cloud identity takeover, RMM persistence, ransomware affiliate","tags":"adversary-emulation, scattered-spider, unc3944, social-engineering, identity, ecrime","mitre_attack":"T1656, T1598, T1621, T1078.004, T1219, T1486"}

Scattered Spider — Adversary Emulation Playbook

Tier-2 native-English-speaking eCrime collective. Their edge is social engineering: impersonating employees to the IT help desk to drive password resets and MFA transfers, then pivoting fast through the identity provider (Okta / Entra ID) into cloud and SaaS, deploying legitimate RMM for persistence, and finishing with data-theft extortion / ransomware. Authorized red-team emulation only — every action runs under the engagement RoE.

When to emulate Scattered Spider

• The client wants their human + identity perimeter tested: help-desk verification process, IdP admin controls, MFA resilience, RMM allow-listing.
• Telecom, BPO/CRM, technology, gaming, hospitality, retail, financial, or MSP targets.
• The scenario is fast and brazen extortion — the opposite of APT29's low-and-slow.

ThreatProfile seed (plan/threat-profile.json)

{
  "engagement_name": "<fill>",
  "actor_name": "Scattered Spider-like (UNC3944 / Octo Tempest)",
  "actor_aliases": ["UNC3944", "Octo Tempest", "Muddled Libra", "Roasted 0ktapus", "Scatter Swine"],
  "group_id": "G1015",
  "tier": "tier-2",
  "sophistication": "high",
  "motivation": "financial",
  "initial_access": ["T1656", "T1598", "T1566.004", "T1078.004"],
  "key_ttps": ["T1621", "T1556.006", "T1098.005", "T1078.004", "T1219", "T1213", "T1486", "T1657"],
  "tools": ["Authorized test persona (vishing)", "AnyDesk / ConnectWise (engagement-owned)", "Sliver", "NetExec", "Impacket"],
  "infrastructure": ["Spoofed/marked caller-ID test line", "Look-alike SSO phishing page", "Attacker-registered MFA device (engagement-controlled)", "Rogue VM in victim vSphere/Azure"],
  "recent_cti_delta": "2023-2025: help-desk impersonation + MFA fatigue + SIM swap; registers its own MFA, creates rogue VMs in vSphere/Azure; pivoted to impersonating employees against third-party IT; ransomware affiliate ALPHV -> RansomHub -> DragonForce.",
  "confidence": "probable"
}

Kill-chain emulation

#	Phase	MITRE	Emulated action	Executing agent → skill
1	Recon (PII)	T1589	Harvest employee names, roles, phone numbers, help-desk reset process	recon → /skills/standard/recon/osint/SKILL.md, /skills/standard/osint/SKILL.md
2	Initial Access	T1656 / T1598 / T1566.004	Vish the help desk as a target employee → password reset + MFA transfer	phisher → /skills/standard/phisher/SKILL.md
3	MFA bypass	T1621 / T1556.006	MFA-fatigue push OR register attacker-controlled MFA device	phisher/exploit → /skills/standard/phisher/SKILL.md, /skills/standard/exploit/web/oauth/SKILL.md
4	Cloud foothold	T1078.004	Sign in to Okta/Entra/AWS as the reset account	cloud → /skills/standard/cloud/aws-iam-enum/SKILL.md, /skills/standard/cloud/azure-managed-identity/SKILL.md
5	Scope expansion	T1098.003 / T1098.005	Self-assign apps in Okta; add roles/credentials; passrole chains	cloud → /skills/standard/cloud/aws-iam-passrole-chain/SKILL.md
6	Persistence	T1219	Deploy engagement-owned RMM (AnyDesk/ConnectWise); create rogue VM	post-exploit → /skills/standard/post-exploit/lateral-movement/SKILL.md, /skills/standard/post-exploit/c2-sliver/SKILL.md
7	On-prem pivot (hybrid)	T1558.003 / T1003	BloodHound the AD; Kerberoast; dump creds	ad → /skills/standard/ad/bloodhound-query/SKILL.md, /skills/standard/ad/kerberoasting/SKILL.md
8	Collection	T1213	Mine SharePoint/Confluence/Slack for secrets + PII (canary)	post-exploit → /skills/standard/post-exploit/credential-access/SKILL.md
9	Exfiltration	T1567.002	Stage + exfil the scoped/canary data set	post-exploit → /skills/standard/post-exploit/reporting/SKILL.md
10	Impact (CANARY)	T1486 / T1657	Demonstrate ransomware/financial-theft capability on canary only	post-exploit → /skills/standard/post-exploit/reporting/SKILL.md

CONOPS kill_chain (copy into conops.json)

1. recon — OSINT/PII + help-desk reset-process recon (1).
2. initial-access — vishing → password reset + MFA takeover → cloud login (2-4).
3. post-exploit — Okta/IAM scope expansion, RMM persistence, optional on-prem AD pivot, SaaS collection (5-8).
4. c2 — Sliver / RMM session (within row 6).
5. exfiltration — data theft → extortion demonstration on canary (9-10).

OPSEC & signature fidelity

• Brazen, not stealthy. Scattered Spider moves in minutes-to-hours and leans on legitimate identity + RMM, so the detection signature is behavioral: a help-desk reset anomaly, a new MFA device, an unexpected RMM install, a new VM. Mirror that pattern so the blue team's detections are exercised.
• Live off the victim's own tooling (vSphere, Azure portal) to create infrastructure.
• Persistence = own MFA token + RMM, not malware implants.

RoE / safety gates

• Social engineering of real staff/help desk requires explicit, written authorization plus HR/legal sign-off and a lure-deconfliction pass (/skills/standard/phisher/lure-deconfliction/SKILL.md). Name exactly which staff/roles are in scope.
• No real SIM swaps against personal numbers (illegal). Simulate the SIM-swap effect with an authorized engagement-controlled test number only.
• Ransomware/financial-theft impact is canary-only; add an EMERGENCY abort trigger: "real customer data exfiltrated, real funds moved, or production system encrypted."

Deconfliction

• Brief a single deconfliction POC (NOT the help desk under test) and use a marked test persona + caller-ID so the activity can be separated from a real Octo Tempest call post-hoc.
• Record the attacker-registered MFA device, RMM install IDs, and any rogue VM in deconfliction.json + cleanup.json.
• Time-box vishing windows; never call outside the agreed hours.

Fidelity notes (deviations)

• The vishing is performed by an authorized tester against a scoped help desk; the point is to measure the reset/verification process, not to deceive arbitrary staff.
• MFA registration uses an engagement-controlled device; RMM is an engagement-owned AnyDesk/ConnectWise tenant.
• Impact is a canary marker proving the access would allow encryption/theft — never a real locker.