Campaign · all campaigns

C0027C0027 unknown

aka C0027

Last updated: 2026-07-03

1attributed CVEs

42ATT&CK techniques

1.2IDF score (tooling uniqueness)

0exclusive CVEs

2026years active

About this actor

[C0027](https://attack.mitre.org/campaigns/C0027) was a financially-motivated campaign linked to [Scattered Spider](https://attack.mitre.org/groups/G1015) that targeted telecommunications and business process outsourcing (BPO) companies from at least June through December of 2022. During [C0027](https://attack.mitre.org/campaigns/C0027) [Scattered Spider](https://attack.mitre.org/groups/G1015) used various forms of social engineering, performed SIM swapping, and attempted to leverage access from victim environments to mobile carrier networks.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

Source: MITRE ATT&CK

Activity timeline

2026 — 1 CVE published

Profile

CVE	Risk	CVSS	EPSS	Published	Products
`CVE-2026-20929`	5.5	7.5	0.0114	2026-01-13	see CVE

Mitigating controls (NIST 800-53)

Control	Techniques covered	Coverage
`SI-4`	26 / 42	62%
`CM-6`	24 / 42	57%
`AC-3`	22 / 42	52%
`AC-2`	20 / 42	48%
`AC-6`	20 / 42	48%
`CM-7`	19 / 42	45%
`IA-2`	19 / 42	45%
`AC-4`	18 / 42	43%
`AC-5`	18 / 42	43%
`CM-2`	18 / 42	43%
`CA-7`	17 / 42	40%
`CM-5`	17 / 42	40%
`SC-7`	15 / 42	36%
`SI-3`	13 / 42	31%
`IA-5`	11 / 42	26%

Co-occurring actors

Mustang Panda 1 shared CVEs
SolarWinds Compromise 1 shared CVEs
APT38 1 shared CVEs
Tonto Team 1 shared CVEs
Ember Bear 1 shared CVEs
GOLD SOUTHFIELD 1 shared CVEs
Aquatic Panda 1 shared CVEs
APT28 1 shared CVEs
Sandworm Team 1 shared CVEs
Ajax Security Team 1 shared CVEs

Similar actors

Similar TTPs

Overlapping CVEs

APT12 1.00
APT28 1.00
FIN7 1.00
OilRig 1.00
Tropic Trooper 1.00