UK-based members of the Scattered Spider hacking group are actively facilitating cyber-attacks, according to Google, as disruption spreads from British retailers to the US. The group has been linked to attacks on Marks & Spencer, the Co-op, and Harrods, with Google cybersecurity experts warning that unnamed US retailers are now being targeted.
Charles Carmakal, chief technology officer at Google's Mandiant cybersecurity unit, noted that the threat has moved to the US in a pattern typical of Scattered Spider. 'They tend to focus on a particular industry sector and geography for a few weeks and then move on to something else,' he said. 'Right now they're focused on retail organisations. They start in the UK, and now they've shifted to US organisations.'
Marks & Spencer recently warned staff that their personal data, including email addresses and full names, may have been stolen in a cyber-attack last month. Earlier this week, the retailer revealed that some customer information was also taken. The National Cyber Security Centre has advised companies to review IT help desk procedures, as Scattered Spider hackers often impersonate employees to reset passwords.
Carmakal explained that younger members of the network are sometimes outsourced to make these calls. 'It's not always the threat actors themselves making the phone calls. They outsource that work to younger individuals on Telegram and Discord who want to make a few hundred bucks,' he said.
Scattered Spider is unusual among ransomware groups as it consists of native English speakers from the UK, US, and Canada. Ransomware attacks involve locking victims' files and demanding payment for their release. Google's threat intelligence analysts anticipate continued targeting of the retail sector in the near term.
