UNC3944

UNC3944, also known as Scattered Spider and Oktapus, is a financially motivated threat actor group that has been expanding its target sectors. Initially focusing on telecommunication firms and tech companies, the group has broadened its attacks to hospitality, retail, media, and financial services. The group's primary modus operandi involves leveraging the Identity Provider (IDP) for initial access into an environment with the intent of stealing Intellectual Property (IP) for extortion purposes. In recent times, the group has notably launched ransomware attacks in the hospitality and retail sectors. The group's tactics have evolved to include more sophisticated methods such as using Azure Serial Console to gain administrative console access to Virtual Machines (VMs). This is achieved through phishing and SIM swapping attacks aimed at taking over Microsoft Azure admin accounts. In Q2 2024, UNC3944 added RansomHub and Qilin ransomware to its arsenal, further demonstrating its adaptability and increasing threat level. The group's ability to effectively use social engineering techniques, thanks to its members' proficiency in American English, has contributed significantly to its success. Law enforcement agencies have made progress in curbing UNC3944's activities. Spanish police arrested a 22-year-old British national suspected of being a key member of the group, while UK law enforcement apprehended a 17-year-old teenager from Walsall believed to be part of the same cybercrime organization. Despite these arrests, the group continues to pose a significant threat, with recent reports suggesting involvement in a cyberattack on hotel and casino giant Caesars Entertainment. UNC3944 has not yet claimed any attacks against the health sector, but given their evolving tactics and targets, this sector should remain vigilant.