Cyber Threat Actor: Scatter Swine

Scatter Swine is a threat actor identified in connection with a June 2022 campaign targeting a cloud communications provider. The group employs voice and SMS phishing tactics to compromise employee credentials, facilitating unauthorized access to corporate systems. This operation demonstrated a focus on bypassing authentication controls to harvest sensitive customer data and manipulate account settings. The actor’s activities align with credential theft and lateral movement objectives, though their underlying motivations remain unspecified in public reporting.

The June 29, 2022, incident involved two distinct breaches attributed to Scatter Swine. Attackers initially leveraged stolen credentials to access limited customer contact information, with the victim organization containing the intrusion within hours. A subsequent breach impacted 209 customers and compromised 93 accounts using two-factor authentication apps, enabling threat actors to view account details and register malicious devices. This multi-phase attack persisted undetected for several days, suggesting deliberate operational security measures to prolong access. The campaign formed part of a broader wave targeting multiple organizations, indicating coordinated efforts rather than isolated intrusions.

Twilio, the affected company, mitigated the breaches by resetting compromised credentials and implementing hardware security keys for employee authentication. This response highlights the actor’s reliance on social engineering rather than exploiting technical vulnerabilities for initial access. While Scatter Swine’s infrastructure, affiliations, and geographical origins remain unconfirmed, their operations underscore the continued effectiveness of phishing techniques against human-centric security layers. The group’s ability to maintain persistence and target authentication mechanisms reflects a strategic focus on identity compromise as a gateway to valuable organizational assets.