UNC3944

UNC3944, also known as Scattered Spider and 0ktapus, is a financially motivated threat actor group that has been increasingly active in recent years. The group initially targeted telecommunication firms and tech companies but has now expanded its operations to include the hospitality, retail, media, and financial services sectors. UNC3944 uses a variety of techniques to gain initial access into an environment, such as leveraging the Identity Provider (IDP) and deploying ransomware attacks. The group's modus operandi includes stealing Intellectual Property (IP) for extortion purposes. Notably, they have added RansomHub and Qilin ransomware to their arsenal in the second quarter of 2024. UNC3944 has demonstrated a sophisticated understanding of cloud-based systems, specifically Microsoft Azure. The group has been using phishing and SIM swapping attacks to take over Microsoft Azure admin accounts, gaining access to virtual machines (VMs). Their next step involves using Azure Serial Console to gain administrative console access to VMs, further enhancing their control over the compromised systems. Their focus on VMs seems strategic, as these machines often run critical operations, making them high-value targets for ransomware attacks. Law enforcement efforts against UNC3944 have seen some success. A 22-year-old British national suspected of being a key member of the group was arrested by Spanish police, while UK law enforcement apprehended a 17-year-old teenager from Walsall under similar suspicions. Despite these arrests, the group remains active and continues to pose a significant threat. UNC3944 has not yet claimed any attacks against the health sector, but given their expanding range of targets, it's a possibility that cannot be ruled out.