Team Cymru Shares Scattered Spider Infrastructure Profile and Hunting Guidance
Summary
Team Cymru profiles infrastructure reported in Scattered Spider operations—including VPNs, residential proxies, tunneling and file-sharing services, RMM tools and SSO-phishing domains—and provides Scout queries and behavioral hunting guidance.
Key points
- Team Cymru's OSINT-based profile describes reported use of consumer VPNs, connection-tunneling and file-sharing services, residential proxies, RMM tools, infostealer infrastructure, and SSO-themed phishing domains.
- The article attributes reported Scattered Spider tactics to social engineering help desks, SSO-themed SMS phishing, SIM swapping, and use of stolen credentials.
- It names Mullvad, NordVPN, and ExpressVPN as regularly observed VPN brands, and Ngrok, Teleport, and Pinggy as reported tunneling tools.
- Because legitimate users share VPN, proxy, and file-sharing infrastructure, the article cautions that blocking individual indicators can cause false positives; it recommends behavioral context.
- Hunting guidance includes reviewing authentication from VPN or residential-proxy IPs, unusual outbound file-sharing traffic, server connections to tunnels paired with inbound SSH or RDP, unapproved RMM communications, and SSO-themed typosquatting domains.
- The article recommends combining network context with phishing-resistant MFA, role-based access control, system hardening, application allow-listing, endpoint analytics, monitoring, and automation.
Article Details
- Defense Focus
- Detect Scattered Spider activity by correlating authentication, network, and infrastructure context, rather than treating shared VPN, proxy, tunneling, or file-sharing services as malicious based on destination alone.
- Detection Methods
- Review successful SSO and VPN authentications from IPs tagged as consumer VPN or residential proxy infrastructure.
- Hunt for outbound connections from internal servers to connection-tunneling endpoints; correlate them with inbound SSH or RDP traffic.
- Identify sudden increases in outbound bytes sent to file-sharing or paste services, and investigate associated destination IPs and their history across organizations.
- Flag internal systems communicating with RMM provider servers when the software is not on the permitted software list.
- Search DNS and passive-DNS data for typosquatting domains using SSO-related terms and organization brand names; examine related nameserver and ASN patterns.
- Enrich internal logs with external infrastructure classifications and investigate whether connections involve proxy, VPN, RMM, file-sharing, tunneling, or paste-site infrastructure.
- Block identified infostealer controller servers and retroactively hunt for previously missed data-exfiltration activity.
- Data Sources
- SSO and VPN authentication logs
- DNS and passive-DNS records, including domain, nameserver, and ASN data
- Outbound network flows and byte counts
- Global NetFlow context for destination IPs
- SSH and RDP connection records
- Internal SIEM logs
- Endpoint and EDR telemetry
- Rule Types
- Scout tag and passive-DNS queries
- Domain-pattern and regex-based hunts
- ASN- and nameserver-based filters
- STIX 2.1 threat-intelligence feed via TAXII
- SOAR automation playbooks
- Platforms
- SIEM platforms
- Threat intelligence platforms (TIPs)
- SOAR platforms
- Endpoint security and EDR platforms
- Defensive Actions
- Use behavioral analytics and contextual enrichment; avoid blanket blocking of shared VPN, proxy, tunneling, and file-sharing infrastructure.
- Review successful logins from tagged VPN or residential proxy IPs, particularly at SSO and VPN endpoints.
- Investigate unapproved RMM activity and maintain an allowlist of permitted software.
- Use phishing-resistant MFA, role-based access control, system hardening, and application allow-listing.
- Provide security awareness training and continuously monitor authentication, endpoint, and network activity.
- Integrate external infrastructure intelligence with internal logs and use automation to respond to suspicious activity, such as large transfers to unvetted file-sharing services.
MITRE ATT&CK
T1078 · Valid AccountsThe article says Scattered Spider members use valid stolen credentials to log in remotely to target accounts.T1090 · ProxyThe article describes operators routing traffic through VPN and residential proxy infrastructure to mask source IP addresses and evade location-based controls.T1219 · Remote Access ToolsThe group reportedly uses legitimate RMM software, including AnyDesk and TeamViewer, to gain access and evade AV and EDR.T1486 · Data Encrypted for ImpactAfter obtaining privileged access, Scattered Spider reportedly deploys ransomware from RaaS platforms.T1539 · Steal Web Session CookieThe article says cookies are among the data stolen by infostealer malware before credentials are used to access target accounts.T1566.003 · Spearphishing via ServiceThe article reports SSO-themed SMS phishing campaigns linked to Scattered Spider intrusions.T1567.002 · Exfiltration to Cloud StorageThe article reports exfiltration of stolen data through online file-sharing services.T1567.003 · Exfiltration to Text Storage SitesThe article reports that stolen data and dumped credentials are transmitted through text-paste sites.T1656 · ImpersonationOperators reportedly call IT help desks while posing as employees to persuade technicians to reset passwords or install RMM software.
Threat Actors
0ktapusThe article identifies 0ktapus as a name used for Scattered Spider by Group-IB.Scatter SwineThe article identifies Scatter Swine as a name used for Scattered Spider by Okta.Scattered SpiderThe article describes Scattered Spider as a cybercriminal group and links it to multiple reported intrusions, ransomware attacks, SMS phishing, stolen-credential use, data exfiltration, and ransomware deployment.UNC3944The article identifies UNC3944 as a name used for Scattered Spider by Google Mandiant.
Malware
ALPHV/BlackCatdisclosed via their US Security Exchange Commission (SEC) filing that the overall cost from the ALPHV/BlackCat ransomware attack that was linked to Scattered Spider was $100 million USD. In mid-2025, Marks &DragonForceUSD. In mid-2025, Marks & Spencer said it will take an estimated £300 million hit following the DragonForce ransomware attack, linked to Scattered Spider. Google’s security experts also assessed that ScatteredLummatag = "redline,raccoonstealer,lumma,warzone-rat,vidar,rhadamanthys,stealc"Qilin(RaaS) platforms developed by Russian-speaking threat actors. This includes ALPHV/BlackCat, Qilin, RansomHub, and DragonForce.RansomHub(RaaS) platforms developed by Russian-speaking threat actors. This includes ALPHV/BlackCat, Qilin, RansomHub, and DragonForce.RedLinetag = "redline,raccoonstealer,lumma,warzone-rat,vidar,rhadamanthys,stealc"Rhadamanthystag = "redline,raccoonstealer,lumma,warzone-rat,vidar,rhadamanthys,stealc"StealCtag = "redline,raccoonstealer,lumma,warzone-rat,vidar,rhadamanthys,stealc"Vidartag = "redline,raccoonstealer,lumma,warzone-rat,vidar,rhadamanthys,stealc"
Vendors
Products
AnyDeskLegitimate RMM tools such as AnyDesk and TeamViewer, among others, have been dual-used by Scattered Spider members to evade Anti-Virus (AV) and endpoint detection and response (EDR). Due to the software being legitimateCisco Duohave been known to gain initial access via SMS phishing campaigns mimicking SSO providers such as Okta, Cisco DUO, and PingID, among others. To mimic these services, similar-looking typosquatting domains are registeredOktasuch as UNC3944 by Google Mandiant, 0ktapus by Group-IB, Octo Tempest by Microsoft, Scatter Swine by Okta, and Muddled Libra by Palo Alto Networks.PingIDto gain initial access via SMS phishing campaigns mimicking SSO providers such as Okta, Cisco DUO, and PingID, among others. To mimic these services, similar-looking typosquatting domains are registered following aTeamViewerLegitimate RMM tools such as AnyDesk and TeamViewer, among others, have been dual-used by Scattered Spider members to evade Anti-Virus (AV) and endpoint detection and response (EDR). Due to the software being legitimateVMware ESXiavailable SSO-integrated applications and aims to move laterally to virtualised environments such as VMware ESXi hypersvisors or cloud-hosted virtual machines. Once privileged access has been acquired, Scattered
Tools
Ngrokof VPN and proxy infrastructure creates a blended threat environment. When an alert triggers for an Ngrok tunnel, file-sharing service, or a login from an unknown residential IP, it is not immediately clear if itPinggyConnection proxy tools have been reportedly used by Scattered Spider operators according to cybersecurity vendor blogs (Google, Palo Alto Networks). This includes Ngrok, Teleport, and Pinggy.TeleportConnection proxy tools have been reportedly used by Scattered Spider operators according to cybersecurity vendor blogs (Google, Palo Alto Networks). This includes Ngrok, Teleport, and Pinggy.