Octo Tempest

Octo Tempest, also known as Scattered Spider or 0ktapus, is a notable threat actor group in the cybercrime landscape. The group, comprised of five individuals in their early 20s, has been linked to major data extortion campaigns against high-profile targets such as Caesars Entertainment and MGM, often collaborating with the notorious Black Cat/ALPHV ransomware group. Recently, Octo Tempest has added RansomHub and Qilin ransomware to its arsenal, further enhancing its capabilities and posing an increased threat to organizations worldwide. The group has demonstrated a rapid rise in the ransomware game, leveraging sophisticated techniques to launch attacks. It has exploited vulnerabilities such as CVE-2024-37085 to deploy ransomware strains such as Akira and Black Basta. Microsoft and other security vendors have identified Octo Tempest alongside other ransomware outfits like Storm-0506 (aka Black Basta), Manatee Tempest, and Storm-1175, who are also exploiting these vulnerabilities for mass encryption attacks. Microsoft's security researchers have reported that multiple financially motivated groups, including Octo Tempest, have already utilized this post-compromise technique in numerous attacks. This evolution of Octo Tempest into ransomware operations represents a significant shift in its tactics and showcases its adaptability. Given its proven ability to exploit vulnerabilities and collaborate with other notorious groups, Octo Tempest continues to pose a serious cybersecurity threat.