campaign

C0027 C0027

First seen: June 2022
Last seen: December 2022
Created: 30 June 2023
Last modified: 31 July 2026

C0027 was a financially-motivated campaign linked to Scattered Spider that targeted telecommunications and business process outsourcing (BPO) companies from at least June through December of 2022. During C0027 Scattered Spider used various forms of social engineering, performed SIM swapping, and attempted to leverage access from victim environments to mobile carrier networks.[1]

TechniquesTop 18%

TacticsTop 11%

Tool or malware45th pct

Threat groupunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing C0027

Reach is how much of ATT&CK this campaign touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 56 ATT&CK campaigns only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	The following analytic identifies access to the /api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark endpoint, which is associated with CVE-2023-46805 and CVE-2024-21887 vulnerabilities. (...)	Generic	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2024-21887 CVE-2023-46805 CVE-2023-46085	medium	Michael Haag, Splunk	2024-01-17	2026-05-13	15838756-f425-43fa-9d88-a7f88063e81a
	Detects when an account is disabled or blocked for sign in but tried to log in	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Yochana Henderson, '@Yochana-H'	2022-06-17	—	4afac85c-224a-4dd7-b1af-8da40e1c60bd
	Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.	Generic	test	account_management	windows	WinEventLog Security	Credential Access OS Credential Dumping DCSync	-	medium	Roberto Rodriguez @Cyb3rWard0g	2019-07-26	2026-07-30	17d619c1-e020-4347-957e-1d1207455c93
	Detects when a new credential is added to an existing application. (...)	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Persistence, Privilege Escalation Account Manipulation Additional Cloud Credentials	-	high	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-05-26	2026-08-20	cbb67ecc-fb70-4467-9350-c910bdf7c628
Splunk	The following analytic detects potential exploitation attempts against Adobe ColdFusion vulnerabilities CVE-2023-29298 and CVE-2023-26360. (...)	Anomaly	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2023-29298 CVE-2023-26360	medium	Michael Haag, Splunk	2023-08-23	2026-05-13	d6821c0b-fcdc-4c95-a77f-e10752fae41a
Splunk	The following analytic detects potential exploitation of the Adobe ColdFusion vulnerability, CVE-2023-26360, which allows unauthenticated arbitrary file read. (...)	Anomaly	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2023-26360	medium	Michael Haag, Splunk	2023-08-23	2026-05-13	695aceae-21db-4e7f-93ac-a52e39d02b93
	Detects suspicious access to URLs that was noticed in cases in which attackers exploitated the ADSel (...)	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2021-40539	high	Tobias Michalski (Nextron Systems), Max Altgelt (Nextron Systems)	2021-09-20	2023-01-02	6702b13c-e421-44cc-ab33-42cc25570f11
Splunk	The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Network Service Discovery Discovery Network Share Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-10-24	2026-05-13	9a4e50c7-5b62-4d52-93b4-f2b61332e9a5
	Detects the use of Advanced IP Scanner. (...)	Generic	test	file_event	windows	Sysmon	Discovery Network Service Discovery	-	medium	@ROxPinTeddy	2020-05-12	2022-11-29	fed85bf9-e075-4280-9159-fbe8a023d6fa
	Detects a highly relevant Antivirus alert that reports APT malware. (...)	Generic	experimental	antivirus	-	-	Execution Exploitation for Client Execution Command and Control Remote Access Tools Remote Desktop Software	-	critical	Arnim Rupp (Nextron Systems)	2026-06-15	—	101a1877-2cf4-474d-abfd-7f6ac4788d1a
	Detects a highly relevant Antivirus alert that reports an exploitation framework. (...)	Generic	stable	antivirus	-	-	Execution Exploitation for Client Execution Command and Control Remote Access Tools Remote Desktop Software	-	critical	Florian Roth (Nextron Systems), Arnim Rupp	2018-09-09	2026-06-15	238527ad-3c2c-4e4f-a1f6-92fd63adb864
	Detects a highly relevant Antivirus alert that reports a remote access tool. (...)	Generic	experimental	antivirus	-	-	Execution Exploitation for Client Execution Command and Control Remote Access Tools Remote Desktop Software	-	critical	Arnim Rupp (Nextron Systems)	2026-06-15	—	97233998-3838-4581-88c6-f1d19d3993fb
	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. (...)	Generic	test	file_event	windows	Sysmon	Command and Control Remote Access Tools Remote Desktop Software	-	medium	frack113	2022-02-11	2024-07-20	0b9ad457-2554-44c1-82c2-d56a99c42377
	Detects attempts to exploit an apache spark server via CVE-2014-6287 from a commandline perspective	Emerging	test	process_creation	linux	Sysmon	Initial Access Exploit Public-Facing Application	CVE-2014-6287 CVE-2022-33891	high	Nasreddine Bencherchali (Nextron Systems)	2022-07-20	—	c8a5f584-cdc8-42cc-8cce-0398e4265de3
	Detects attempts to exploit an apache spark server via CVE-2014-6287 from a weblogs perspective	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2014-6287 CVE-2022-33891	high	Nasreddine Bencherchali (Nextron Systems)	2022-07-19	2023-01-02	1a9a04fd-02d1-465c-abad-d733fd409f9c
	Detects an issue in apache logs that reports threading related errors	Generic	test	-	-	Apache	Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services	-	medium	Florian Roth (Nextron Systems)	2019-01-22	2021-11-27	e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c
	Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Persistence, Privilege Escalation Account Manipulation Additional Cloud Roles	-	medium	Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'	2022-07-19	2024-11-04	b04934b2-0a68-4845-8a19-bdfed3a68a7a
	Detects when administrator grants either application permissions (app roles) or highly privileged de (...)	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Persistence, Privilege Escalation Account Manipulation Additional Cloud Roles	-	high	Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'	2022-07-28	2023-03-29	5aecf3d5-f8a0-48e7-99be-3a759df7358f
	Detects when a configuration change is made to an applications AppID URI.	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Credential Access Unsecured Credentials Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-06-02	—	1b45b0d1-773f-4f23-aedc-814b759563b1
	Detects the removal or uninstallation of an application via "Wmic.EXE".	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Windows Management Instrumentation	-	medium	frack113	2022-01-28	2024-07-02	b53317a0-8acf-4fd1-8de8-a5401e776b96
	Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Windows Management Instrumentation	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-09-11	—	49d9671b-0a0a-4c09-8280-d215bfd30662
	Detects when a configuration change is made to an applications URI. (...)	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Credential Access Steal Application Access Token Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-06-02	—	0055ad1f-be85-4798-83cf-a6da17c993b3
	Detects DNS queries made by "AppInstaller.EXE". (...)	Generic	test	dns	windows	Sysmon	Command and Control Ingress Tool Transfer	-	medium	frack113	2021-11-24	2023-11-09	7cff77e1-9663-46a3-8260-17f2e1aa9d0a
	Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	medium	Victor Sergeev, oscd.community	2020-10-09	2023-10-18	eee00933-a761-4cd0-be70-c42fe91731e7
	Detects exploitation of vulnerabilities in Arcadyan routers as reported in CVE-2021-20090 and CVE-2021-20091.	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2021-20091 CVE-2021-20090	critical	Bhabesh Raj	2021-08-24	2023-01-02	f0500377-bc70-425d-ac8c-e956cd906871
Splunk	The following analytic identifies the creation of a new AWS IAM policy version that allows access to all resources. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Patrick Bareiss, Splunk	2021-02-22	2026-05-13	22cc7a62-3884-48c4-82da-592b8199b72f
Splunk	The following analytic detects the successful deletion of a group within AWS IAM, leveraging CloudTrail IAM events. (...)	Hunting	stable	cloud_audit	-	AWS CloudTrail · AWS	Persistence, Privilege Escalation Account Manipulation Discovery Permission Groups Discovery Cloud Groups	-	medium	Patrick Bareiss, Splunk	2024-05-22	2026-05-13	1bbe54f1-93d7-4764-8a01-ddaa12ece7ac
Splunk	The following analytic detects attempts to disable multi-factor authentication (MFA) for an AWS IAM user. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Resource Development Compromise Accounts Cloud Accounts Persistence, Defense Impairment, Credential Access Modify Authentication Process Multi-Factor Authentication Credential Access Multi-Factor Authentication Request Generation	-	medium	Patrick Bareiss, Splunk	2022-10-04	2026-05-13	4d2df5e0-1092-4817-88a8-79c7fa054668
	Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently foun (...)	Generic	test	-	windows	WinEventLog Application	Command and Control Remote Access Tools Remote Desktop Software	-	high	Bhabesh Raj	2021-09-01	2022-12-25	87261fb2-69d0-42fe-b9de-88c6b5f65a43
	Detects attempts to exploit the Atlassian Bitbucket Command Injection CVE-2022-36804	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2022-36804	high	Nasreddine Bencherchali (Nextron Systems)	2022-09-29	2023-01-02	65c0a0ab-d675-4441-bd6b-d3db226a2685
	Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate suc (...)	Emerging	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Initial Access Exploit Public-Facing Application	CVE-2022-26134	high	Nasreddine Bencherchali (Nextron Systems)	2022-06-03	—	7fb14105-530e-4e2e-8cfb-99f7d8700b66
	Detects potentially suspicious events involving "GetSigninToken". (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Lateral Movement Remote Services Cloud Services Lateral Movement Use Alternate Authentication Material Application Access Token	-	medium	Chester Le Bron (@123Le_Bron)	2024-02-26	—	f8103686-e3e8-46f3-be72-65f7fcb4aa53
Splunk	The following analytic identifies failed authentication attempts to the AWS Console during the Multi-Factor Authentication (MFA) challenge. (...)	Generic	stable	authentication	-	AWS CloudTrail · AWS	Resource Development Compromise Accounts Cloud Accounts Credential Access Multi-Factor Authentication Request Generation	-	medium	Bhavin Patel, Splunk	2022-10-03	2026-05-13	55349868-5583-466f-98ab-d3beb321961e
	Detects AWS console logins from countries and IP addresses that are not recognized as legitimate for the organization. (...)	Placeholder	experimental	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Ivan Saakov	2025-10-19	—	313e72de-0c0d-4d65-8c95-87f4d546eceb
Splunk	The following analytic identifies the creation of a new AWS IAM policy version that allows access to all resources. (...)	Generic	stable	account_management	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Bhavin Patel, Splunk	2021-02-22	2026-05-13	2a9b80d3-6340-4345-b5ad-212bf3d0dac4
	Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter Cloud API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	daniel.bohannon@permiso.io (@danielhbohannon)	2023-05-17	—	db014773-b1d3-46bd-ba26-133337c0ffee
	Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>".	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter Cloud API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	daniel.bohannon@permiso.io (@danielhbohannon)	2023-05-17	—	db014773-7375-4f4e-b83b-133337c0ffee
	Detects S3 Browser utility creating IAM User or AccessKey.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter Cloud API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	daniel.bohannon@permiso.io (@danielhbohannon)	2023-05-17	—	db014773-d9d9-4792-91e5-133337c0ffee
Splunk	The following analytic identifies the successful deletion of an IAM group in AWS. (...)	Hunting	stable	account_management	-	AWS CloudTrail · AWS	Persistence, Privilege Escalation Account Manipulation Discovery Permission Groups Discovery Cloud Groups	-	medium	Michael Haag, Splunk	2021-04-06	2026-05-13	e776d06c-9267-11eb-819b-acde48001122
Splunk	The following analytic detects attempts to disable multi-factor authentication (MFA) for an AWS IAM user. (...)	Generic	stable	authentication	-	AWS CloudTrail · AWS	Resource Development Compromise Accounts Cloud Accounts Persistence, Defense Impairment, Credential Access Modify Authentication Process Multi-Factor Authentication Credential Access Multi-Factor Authentication Request Generation	-	medium	Bhavin Patel, Splunk	2022-10-04	2026-05-13	374832b1-3603-420c-b456-b373e24d34c0
Splunk	The following analytic identifies multiple failed multi-factor authentication (MFA) requests to an AWS Console for a single user. (...)	Anomaly	stable	authentication	-	AWS CloudTrail · AWS	Resource Development Compromise Accounts Cloud Accounts Credential Access Multi-Factor Authentication Request Generation	-	medium	Bhavin Patel	2022-10-03	2026-05-13	1fece617-e614-4329-9e61-3ba228c0f353
	Detects AWS root account usage	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	vitaliy0x1	2020-01-21	2022-10-09	8ad1600d-e9dc-4251-b0ee-a65268f29add
	Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Impact Account Access Removal Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Ivan Saakov	2024-12-19	—	ccd6a6c8-bb4e-4a91-9d2a-07e632819374
Splunk	The following analytic detects when a user sets a default policy version in AWS. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Bhavin Patel, Splunk	2021-03-02	2026-05-13	2a9b80d3-6340-4345-11ad-212bf3d0dac4
	Detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAgent indicates TruffleHog. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Discovery Account Discovery Cloud Account	-	medium	Adan Alvarez @adanalvarez	2025-10-12	—	9b1b8e9b-0a5d-4af1-9d2f-4c4b6e7c2c9d
	Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA). (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Thuya@Hacktilizer, Ivan Saakov	2025-10-18	2025-10-21	77caf516-34e5-4df9-b4db-20744fea0a60
Splunk	The following analytic identifies a successful Console Login authentication event for an AWS IAM user account without Multi-Factor Authentication (MFA) enabled. (...)	Generic	stable	authentication	-	AWS CloudTrail · AWS	Resource Development Compromise Accounts Cloud Accounts Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Bhavin Patel, Splunk	2022-10-04	2026-05-13	a520b1fe-cc9e-4f56-b762-18354594c52f
	Detects file creation events linked to the Axios NPM supply chain compromise. (...)	Emerging	experimental	file_event	linux	Sysmon	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	b7cb840c-11f6-47f7-b3ef-5524739c9077
	Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...)	Emerging	experimental	file_event	macos	-	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	2db0458c-05c9-4069-a26f-77becd9c8c13
	Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...)	Emerging	experimental	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Unix Shell Python Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	0a23a62d-c5b3-468b-a072-25064a9a8c87

Title

Description

C0027 C0027

C0027 C0027

C0027 MITRE reference C0027

Standing C0027

Reach

Coverage

C0027 detections C0027