UNC3944, aka Scattered Spider or 0ktapus, is evolving their attack methodology and expanding their target scope. The group has been notorious for phone-based social engineering and SMS phishing campaigns to obtain initial credentials that can be used to escalate access within a victim’s organization. The threat actor has often leveraged victims’ credentials to call the organization’s service desk while impersonating the employee in order to gain multi-factor authentication (MFA) codes and/or initiate password resets. Researchers have directly observed the group expanding their targeting from primarily telecommunications and business process outsourcers (BPOs) to include a far wider range of industries including hospitality, retail, media and entertainment, and financial services. More notably, the financially motivated threat actors are pivoting to ransomware deployment as part of their expanding monetization strategy which began in mid-2023. They have showcased a greater ability and interest in stealing large amounts of sensitive data for extortion purposes, as opposed to their previous focus on collecting credentials and accessing systems used to enable SIM swapping attacks. UNC3944 was likely supporting secondary criminal operations throughout 2022 and has since transformed their end goals to become a threat actor with an expanded target scope and the capability to operate with an extremely high operational tempo, accessing critical systems and exfiltrating large volumes of data in just a few days. Ransomware deployments by UNC3944 have involved heavy targeting of victim’s business-critical virtual machines and other systems, likely as a means to maximize impact, relying on a combination of publicly available tools, legitimate software, and malware available on underground forums to carry out their attacks.