Scattered Spider to Telecom Fraud Evidence Matrix
BLUF. Scattered Spider (UNC3944) and SIM-farm / temp-SMS ecosystems attack different gates in the same account-takeover chain: SS-06 defeats app-layer OTP; SS-01/SS-05 defeat human recovery and workforce identity gates. The att-callcenter harness COAs test those gates separately — consumer care (A), business blast radius (B), workforce/vendor (C).
Boundaries
- Public-source and authorized tabletop planning only.
- SIMCartel seized sites (
gogetsms.com, apisim.com) are law-enforcement-controlled — do not access.
- Hendricks OTP demo is a defensive control input, not bypass instructions.
Source register (SS-01..06)
| ID |
Source |
Mechanism |
Confidence |
| SS-01 |
CISA AA23-320A |
Help-desk vishing, MFA reset, 2025 AiTM |
confirmed-technique |
| SS-02 |
CISA AA24-190A |
Infostealer → cloud SaaS |
confirmed-technique |
| SS-03 |
Public reporting — MGM (Sep 2023) |
Help-desk → Okta admin |
snapshot |
| SS-04 |
Public reporting — Caesars (Sep 2023) |
Trusted IT vendor (T1199) |
snapshot |
| SS-05 |
UNC3944 telecom/BPO reporting |
BPO vishing, SIM swap, OTP intercept |
confirmed-technique |
| SS-06 |
dumpster/Mobility/2026-08-01-linkedin-dlaskov-sim-farms |
SIM-box, temp-SMS, SIMCartel |
confirmed-technique + snapshot |
Master evidence matrix
| Source ID |
Mechanism |
MITRE |
Mobility intake |
Harness COA |
Tabletop |
Control |
| SS-01 |
Help-desk / care human MFA bypass |
T1566.004 |
Care parallel (not IT desk) |
C, A |
RT-TT-C01, RT-TT-07 |
Fail-closed proof; no privileged phone reset |
| SS-02 |
Infostealer → cloud |
T1597.002 |
— |
B |
RT-TT-B02 |
Bulk cap; tenant isolation |
| SS-03 |
IdP admin after MFA reset |
T1484.002 |
— |
B, C |
Facilitator beats 5–6 |
IdP dual control |
| SS-04 |
Outsourced IT vendor |
T1199 |
BPO overlap (sentiment) |
C |
RT-TT-C01 |
VDI role + offboarding |
| SS-05 |
Telecom/BPO targeting |
T1111, T1566.004 |
Workforce path to care |
C, A |
RT-TT-C01, RT-TT-07 |
BPO limits; SIM hold |
| SS-06 |
SIM-box / temp-SMS OTP |
fraud ecosystem |
Primary — see intake folder |
A |
RT-TT-07 |
Correlation P1-A09; kill switch P1-A10 |
SS-06 — SIM-farm intake artifacts
| Artifact |
Path |
Claim |
| BLUF |
dumpster/Mobility/2026-08-01-linkedin-dlaskov-sim-farms/1. BLUF/summary.md |
SIM farms, OTP demo, SIMCartel |
| Metadata |
dumpster/Mobility/2026-08-01-linkedin-dlaskov-sim-farms/0. Metadata/metadata.md |
Provenance, fetch method, safety screen |
| Hendricks talk meta |
.../youtube-lEbD10UsB08-metadata.json |
InsomniHack ~45 min |
| News clip meta |
.../youtube-kDjyYR9BemM-metadata.json |
SIMCartel raid footage |
| SIMCartel reporting |
.../securityaffairs-simcartel.html, bleepingcomputer-simcartel.md |
Oct 2025 takedown figures |
| Prior capture |
dumpster/Mobility/2026-07-09-linkedin-dlaskov-sim-farms/ |
Same URL; browser baseline |
Combined ATO chain
flowchart TB
subgraph Layer1["App layer — SS-06"]
T1[temp-SMS / SIM-box]
T2[OTP intercept]
end
subgraph Layer2["Human gate — SS-01 / SS-05"]
H1[Care / IT social eng]
H2[SIM eSIM port recovery]
end
ATO[Account takeover]
T1 --> T2 --> ATO
H1 --> H2 --> ATOHarness cross-links
Canonical engagement copy (full tables):
projects/ai-research/harnesses/offsec-pipeline/engagements/att-callcenter-2026-07-31/intel/artifacts/scattered-spider-sim-evidence-matrix.mdmdmp/18-scattered-spider-coa-annotations.mdmdmp/19-mgm-facilitator-run-sheet.mdmdmp/17-coa-scenario-narratives.md
Defensive control checklist
See also