Scattered Spider

Octo Tempest is a financially motivated intrusion set best known for social engineering and identity compromise rather than heavy custom malware. Microsoft describes the group as using broad social engineering campaigns to compromise organizations for extortion, including encryption and destruction, and highlights an industry “wave” pattern where targeting concentrates on a sector for weeks before pivoting. The joint FBI/CISA advisory (AA23-320A) characterizes the group as targeting large companies and their contracted IT help desks, using phone/SMS pretexts, MFA fatigue, and SIM swap techniques to obtain access, install remote tools, and bypass MFA.