Gold Open Source
ExplorePackagesVulnerabilitiesMCP Servers
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Campaigns/C0027
MITRE ATT&CK Campaign · 2022–2022

C0027 (C0027)

ShareXLinkedInRedditHN

[C0027](https://attack.mitre.org/campaigns/C0027) was a financially-motivated campaign linked to [Scattered Spider](https://attack.mitre.org/groups/G1015) that targeted telecommunications and business process outsourcing (BPO) companies from at least June through December of 2022. During [C0027](https://attack.mitre.org/campaigns/C0027) [Scattered Spider](https://attack.mitre.org/groups/G1015) used various forms of social engineering, performed SIM swapping, and attempted to leverage access from victim environments to mobile carrier networks.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

▪Attributed groups (1)

G1015Scattered Spider

▪Techniques used (28)

T1684.001ImpersonationT1572Protocol TunnelingT1190Exploit Public-Facing Application

▪Software used (1)

S0357Impackettool
C0027 on MITRE ATT&CK →
T1087.004Cloud Account
T1102Web Service
T1069.003Cloud Groups
T1598.004Spearphishing Voice
T1003.006DCSync
T1105Ingress Tool Transfer
T1098.003Additional Cloud Roles
T1578.002Create Cloud Instance
T1046Network Service Discovery
T1021.007Cloud Services
T1213.002Sharepoint
T1078.004Cloud Accounts
T1087.003Email Account
T1598.001Spearphishing Service
T1621Multi-Factor Authentication Request Generation
T1098.005Device Registration
T1219.002Remote Desktop Software
T1047Windows Management Instrumentation
T1098.001Additional Cloud Credentials
T1133External Remote Services
T1530Data from Cloud Storage
T1588.002Tool
T1589.001Credentials
T1090Proxy
T1566.004Spearphishing Voice

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.