UNC3944 Targets SaaS Applications

Introduction

UNC3944 is a financially motivated threat group that carries significant overlap with public reporting of "0ktapus," "Octo Tempest," "Scatter Swine," and "Scattered Spider" and has been observed adapting its tactics to include data theft from software-as-a-service (SaaS) applications to attacker-owned cloud storage objects (using cloud synchronization tools), persistence mechanisms against virtualization platforms, and lateral movement via SaaS permissions abuse. Active since at least May 2022, UNC3944 has leveraged underground communities like …

0ktapus applications as-a-service attacker cloud cloud storage data data theft from software introduction lateral lateral movement mechanisms octo octo tempest persistence platforms public reporting saas saas applications scattered spider scatter swine service software spider storage synchronization tactics tempest theft threat threat group threat intelligence tools unc3944 using virtualization