Microsoft is tracking a cybercriminal group called “Octo Tempest” that uses threats of violence as part of its social engineering and data theft extortion campaigns.
“Octo Tempest is a financially motivated collective of native English-speaking threat actors known for launching wide-ranging campaigns that prominently feature adversary-in-the-middle (AiTM) techniques, social engineering, and SIM swapping capabilities,” the researchers write.
“Octo Tempest, which overlaps with research associated with 0ktapus, Scattered Spider, and UNC3944, was initially seen in early 2022, targeting mobile telecommunications and business process outsourcing organizations to initiate phone number ports (also known as SIM swaps). Octo Tempest monetized their intrusions in 2022 by selling SIM swaps to other criminals and performing account takeovers of high-net-worth individuals to steal their cryptocurrency.”
The threat actor relies on social engineering to gain initial access to its victims’ environments.
“Octo Tempest commonly launches social engineering attacks targeting technical administrators, such as support and help desk personnel, who have permissions that could enable the threat actor to gain initial access to accounts,” Microsoft says. “The threat actor performs research on the organization and identifies targets to effectively impersonate victims, mimicking idiolect—the speech habits peculiar to a particular person—on phone calls and understanding personal identifiable information to trick technical administrators into performing password resets and resetting multi-factor authentication (MFA) methods. Octo Tempest has also been observed impersonating newly hired employees in these attempts to blend into normal on-hire processes.”
The group has expanded its operations and grown more aggressive since the beginning of the year. It also became an affiliate of the ALPHV/BlackCat ransomware-as-a-service operation.
“In late 2022 to early 2023, Octo Tempest expanded their targeting to include cable telecommunications, email, and technology organizations,” Microsoft says. “During this period, Octo Tempest started monetizing intrusions by extorting victim organizations for data stolen during their intrusion operations and in some cases even resorting to physical threats.”
KnowBe4 enables your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Microsoft has the story.
Here's how it works:
