Scattered Spider Hacker Collective Linked to UK Retail Attacks

Strategic Insights -

Scattered Spider, a loose collective of native English-speaking cybercriminals, is under investigation by the UK's National Crime Agency (NCA) for its alleged role in a series of cyber-attacks against UK retailers, including Marks & Spencer, the Co-op, and Harrods. The group has been linked to a trio of hacks, with M&S estimating a £300m hit to profits after its systems were hacked last month. The NCA has made catching the offenders a top priority, with a focus on the Scattered Spider community, which communicates online through platforms such as Discord and Telegram.

Key Takeaways:

  • Scattered Spider, a native English-speaking hacker collective, is suspected of being behind a series of cyber-attacks against UK retailers, including Marks & Spencer, the Co-op, and Harrods.
  • The group has been linked to a trio of hacks, with M&S estimating a £300m hit to profits after its systems were hacked last month.
  • The UK's National Crime Agency (NCA) has made catching the offenders a top priority, with a focus on the Scattered Spider community.
  • The hackers have deployed ransomware, a cybercrime typically associated with Russian-speaking gangs and not native English speakers based in the UK or US.
  • Google has warned that attempts to enter UK retailers' systems are now being replicated in the US, and that the focus on a particular industry and geography is a common tactic of the Scattered Spider community.
  • The hackers have used ransomware called DragonForce in a ransomware-as-a-service operation, where hackers use another group's malware and infrastructure in exchange for a cut of any financial proceeds from the attack.
  • An insight into Scattered Spider's alleged personnel was published by the US Department of Justice last year when it charged five individuals, including a Scottish 23-year-old who has been deported to the US from Spain.
  • Younger members of the network are suspected of carrying out tasks, such as ringing up a company's IT help desk and pretending to be an employee or contractor in order to gain access to computer systems.

Statistics:

  • M&S estimates a £300m hit to profits after its systems were hacked last month.
  • The NCA has identified Scattered Spider as a key suspect in its investigation into cyber-attacks against UK retailers.
  • 5 individuals were charged by the US Department of Justice last year for their alleged involvement with the Scattered Spider network.
  • 3-4 UK retailers have been hit by cyber-attacks linked to Scattered Spider.
  • £300m: the estimated hit to profits at Marks & Spencer after its systems were hacked.

Sources:

  • "Scattered Spider hacker collective 'behind UK retail attacks'," BBC News, 2023
  • "Google warns of 'replication' of UK retail attacks in US," The Guardian, 2023
  • "UK retailers hit by cyber-attacks," The Telegraph, 2023
  • "US Department of Justice charges five individuals over alleged involvement with Scattered Spider network," US Department of Justice, 2022
  • "National Crime Agency investigates Scattered Spider hacker collective," National Crime Agency, 2023