C0027

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. C0027 was a financially-motivated campaign linked to Scattered Spider that targeted telecommunications and business process outsourcing (BPO) companies from at least June through December of 2022. During C0027 Scattered Spider used various forms of social engineering, performed SIM swapping, and attempted to leverage access from victim environments to mobile carrier networks.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

This is a historical record and does not establish current campaign activity.

Threat actor

Scattered Spider

Attribution confidence

Not established

First documented activity

2022-06-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2022-06-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2022-12-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1684.001 · Impersonation

  Stealth — During C0027, Scattered Spider impersonated legitimate IT personnel in phone calls and text messages either to direct victims to a credential harvesting site or getting victims to run commercial remote monitoring and management (RMM) tools.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1572 · Protocol Tunneling

  Command And Control — During C0027, Scattered Spider used SSH tunneling in targeted environments.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1190 · Exploit Public-Facing Application

  Initial Access — During C0027, Scattered Spider exploited CVE-2021-35464 in the ForgeRock Open Access Management (OpenAM) application server to gain initial access.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1087.004 · Cloud Account

  Discovery — During C0027, Scattered Spider accessed Azure AD to download bulk lists of group members and to identify privileged users, along with the email addresses and AD attributes.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1102 · Web Service

  Command And Control — During C0027, Scattered Spider downloaded tools from sites including file.io, GitHub, and paste.ee.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1069.003 · Cloud Groups

  Discovery — During C0027, Scattered Spider accessed Azure AD to download bulk lists of group members and their Active Directory attributes.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1598.004 · Spearphishing Voice

  Reconnaissance — During C0027, Scattered Spider used phone calls to instruct victims to navigate to credential-harvesting websites.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1003.006 · DCSync

  Credential Access — During C0027, Scattered Spider performed domain replication.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1105 · Ingress Tool Transfer

  Command And Control — During C0027, Scattered Spider downloaded tools using victim organization systems.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1098.003 · Additional Cloud Roles

  Persistence, Privilege Escalation — During C0027, Scattered Spider used IAM manipulation to gain persistence and to assume or elevate privileges.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1578.002 · Create Cloud Instance

  Defense Impairment — During C0027, Scattered Spider used access to the victim's Azure tenant to create Azure VMs.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1046 · Network Service Discovery

  Discovery — During C0027, used RustScan to scan for open ports on targeted ESXi appliances.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1021.007 · Cloud Services

  Lateral Movement — During C0027, Scattered Spider used compromised Azure credentials for credential theft activity and lateral movement to on-premises systems.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1213.002 · Sharepoint

  Collection — During C0027, Scattered Spider accessed victim SharePoint environments to search for VPN and MFA enrollment information, help desk instructions, and new hire guides.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1078.004 · Cloud Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During C0027, Scattered Spider leveraged compromised credentials from victim users to authenticate to Azure tenants.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1087.003 · Email Account

  Discovery — During C0027, Scattered Spider accessed Azure AD to identify email addresses.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1598.001 · Spearphishing Service

  Reconnaissance — During C0027, Scattered Spider sent Telegram messages impersonating IT personnel to harvest credentials.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1621 · Multi-Factor Authentication Request Generation

  Credential Access — During C0027, Scattered Spider attempted to gain access by continuously sending MFA messages to the victim until they accept the MFA push challenge.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1098.005 · Device Registration

  Persistence, Privilege Escalation — During C0027, Scattered Spider registered devices for MFA to maintain persistence through victims' VPN.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1219.002 · Remote Desktop Software

  Command And Control — During C0027, Scattered Spider directed victims to run remote monitoring and management (RMM) tools.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1047 · Windows Management Instrumentation

  Execution — During C0027, Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1098.001 · Additional Cloud Credentials

  Persistence, Privilege Escalation — During C0027, Scattered Spider used aws_consoler to create temporary federated credentials for fake users in order to obfuscate which AWS credential is compromised and enable pivoting from the AWS CLI to console sessions without MFA.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1133 · External Remote Services

  Persistence, Initial Access — During C0027, Scattered Spider used Citrix and VPNs to persist in compromised environments.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1530 · Data from Cloud Storage

  Collection — During C0027, Scattered Spider accessed victim OneDrive environments to search for VPN and MFA enrollment information, help desk instructions, and new hire guides.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1588.002 · Tool

  Resource Development — During C0027, Scattered Spider obtained and used multiple tools including the LINpeas privilege escalation utility, aws_consoler, rsocx reverse proxy, Level RMM tool, and RustScan port scanner.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1589.001 · Credentials

  Reconnaissance — During C0027, Scattered Spider sent phishing messages via SMS to steal credentials.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1090 · Proxy

  Command And Control — During C0027, Scattered Spider installed the open-source rsocx reverse proxy tool on a targeted ESXi appliance.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

• T1566.004 · Spearphishing Voice

  Initial Access — During C0027, Scattered Spider impersonated legitimate IT personnel in phone calls to direct victims to download a remote monitoring and management (RMM) tool that would allow the adversary to remotely control their system.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0027

  Official MITRE ATT&CK campaign record C0027. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.