Ongoing outages at British retail large Marks & Spencer are brought on by a ransomware assault believed to be performed by a hacking collective often known as “Scattered Spider” BleepingComputer has discovered from a number of sources.
Marks & Spencer (M&S) is a British multinational retailer that employs 64,000 workers and sells numerous merchandise, together with clothes, meals, and residential items in over 1,400 shops worldwide.
Final Tuesday, M&S confirmed it suffered a cyberattack that triggered widespread disruption, together with to its contactless cost system and on-line ordering. Right this moment, Sky Information reported that the disruption continues, with round 200 warehouse employees instructed to remain house as the corporate responds to the assault.
BleepingComputer has now discovered that the continued outages are brought on by a ransomware assault that encrypted the corporate’s servers.
The risk actors are believed to have first breached M&S as early as February, once they reportedly stole the Home windows area’s NTDS.dit file.
An NTDS.dit file is the primary database for Lively Listing Providers working on a Home windows area controller. This file comprises the password hashes for Home windows accounts, which will be extracted by risk actors and cracked offline to realize entry to related plain-text passwords.
Utilizing these credentials, a risk actor can then laterally unfold all through the Home windows area, whereas stealing knowledge from community units and servers.
Sources instructed BleepingComputer that the risk actors in the end deployed the DragonForce encryptor to VMware ESXi hosts on April twenty fourth to encrypt digital machines.
BleepingComputer has discovered that Marks and Spencer requested for assist from CrowdStrike, Microsoft, and Fenix24 to examine and reply to the assault.
The investigation up to now signifies that the hacking collective often known as Scattered Spider, or as Microsoft calls them, Octo Tempest, is behind the assault.
When contacted with this data, M&S mentioned that they might not go into particulars in regards to the cyber incident.
Do you will have details about this or one other cyberattack? If you wish to share the data, you possibly can contact us securely and confidentially on Sign at LawrenceA.11, through electronic mail at [email protected], or through the use of our suggestions type.
Who’s Scattered Spider?
Scattered Spider, often known as 0ktapus, Starfraud, UNC3944, Scatter Swine, Octo Tempest, and Muddled Libra, is a bunch of risk actors which might be adept at utilizing social engineering assaults, phishing, multi-factor authentication (MFA) bombing (focused MFA fatigue), and SIM swapping to realize preliminary community entry on massive organizations.
The group consists of younger English-speaking members (as younger as 16) with various talent units who frequent the identical hacker boards, Telegram channels, and Discord servers. These mediums are then used to plan and conduct assaults in actual time.
Some members are believed to be a part of the “Comm” – a loose-knit neighborhood concerned in violent acts and cyber incidents which have gained vast media consideration.
Whereas the media and researchers generally consult with Scattered Spider as a cohesive gang, they’re really a community of people, with completely different risk actors taking part in every assault. This fluid construction is what makes it tough to trace them.
The group initially began in monetary fraud and social media hacks however later superior to extraordinarily refined social engineering assaults to steal cryptocurrency from people or breach firms in extortion assaults.
The group escalated its assaults in September 2023 once they breached MGM Resorts using a social engineering assault impersonating an worker when calling the corporate’s IT assist desk. On this assault, the risk actors deployed the BlackCat ransomware to encrypt greater than 100 VMware ESXi hypervisors.
This was a pivotal second within the ransomware panorama because it was the primary identified indication that English-speaking risk actors had been working with Russian-speaking ransomware gangs.
Since then, Scattered Spider has been identified to behave as associates for RansomHub, Qilin, and now DragonForce.
DragonForce is a ransomware operation that launched in December 2023, and has not too long ago begun selling a brand new service the place they permit cybercrime groups to white-label their companies.
Researchers generally affiliate assaults with the Scattered Spider group based mostly on particular indicators of compromise, together with credential-stealing phishing assaults concentrating on SSO platforms, social engineering assaults impersonating IT assist desktop, and different techniques.
Cybersecurity agency Silent Push launched a report earlier this month outlining Scattered Spider’s most up-to-date phishing assaults.
Over the previous two years, regulation enforcement has been more and more concentrating on the group, arresting a number of alleged members in the US, the United Kingdom, and Spain.
