Threat intelligence / Campaign

C0027

[C0027](https://attack.mitre.org/campaigns/C0027) was a financially-motivated campaign linked to [Scattered Spider](https://attack.mitre.org/groups/G1015) that targeted telecommunications and business process outsourcing (BPO) companies from at least June through December of 2022. During [C0027](https://attack.mitre.org/campaigns/C0027) [Scattered Spider](https://attack.mitre.org/groups/G1015) used various forms of social engineering, performed SIM swapping, and attempted to leverage access from victim environments to mobile carrier networks.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

Campaign

TypeCampaign

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[C0027](https://attack.mitre.org/campaigns/C0027) was a financially-motivated campaign linked to [Scattered Spider](https://attack.mitre.org/groups/G1015) that targeted telecommunications and business process outsourcing (BPO) companies from at least June through December of 2022. During [C0027](https://attack.mitre.org/campaigns/C0027) [Scattered Spider](https://attack.mitre.org/groups/G1015) used various forms of social engineering, performed SIM swapping, and attempted to leverage access from victim environments to mobile carrier networks.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

30 recorded

Relationships

attributed-to

to Scattered Spider

Group

uses

to Additional Cloud Credentials

Technique

uses

to Additional Cloud Roles

Technique

uses

to Cloud Account

Technique

uses

to Cloud Accounts

Technique

uses

to Cloud Groups

Technique

uses

to Cloud Services

Technique

uses

to Create Cloud Instance

Technique

uses

Technique

uses

to Data from Cloud Storage

Technique

uses

Technique

uses

to Device Registration

Technique

uses

to Email Account

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to External Remote Services

Technique

uses

Tool

uses

to Impersonation

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Multi-Factor Authentication Request Generation

Technique

uses

to Network Service Discovery

Technique

uses

to Protocol Tunneling

Technique

uses

Technique

uses

to Remote Desktop Software

Technique

uses

Technique

uses

to Spearphishing Service

Technique

uses

to Spearphishing Voice

Technique

uses

to Spearphishing Voice

Technique

uses

Technique

uses

Technique

uses

to Windows Management Instrumentation

Technique

2 external

References

mitre-attack

C0027

Crowdstrike TELCO BPO Campaign December 2022

https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/