Cybersecurity

Emulation Scattered Spider

Scattered Spider (UNC3944 / Octo Tempest) adversary-emulation playbook — help-desk vishing → MFA takeover → cloud/SaaS/identity privilege expansion → RMM persistence → data-theft extortion. Use when emulating identity-first social-engineering eCrime against a help-desk/IdP estate. Triggers on: 'emulate Scattered Spider', 'UNC3944', 'Octo Tempest', '0ktapus', 'help desk social engineering', 'MFA fatigue', 'SIM swap', 'identity attack'.

Publisher / source

BitterSecurity/Decepticon (found on GitHub top repositories)

Upstream record

BitterSecurity/Decepticon

Version

Version 1

Published

2026-11-04

Publication review

Approved for publication · recorded passed scan 2026-11-04

Content fingerprint

6e117756115ce97eb633a953476f4392d190331d7d2be9268787161b30b11084