British Police Bust 4 Scattered Spider Suspects in England

British law enforcement arrested four young adults in connection with a recent series of damaging cybersecurity incidents at high-end retailers.

See Also: Strengthening Your Security Program With Open API

As part of an ongoing investigation, Britain’s National Crime Agency said Thursday they arrested a 19-year-old Latvian male, two males aged 17 and 19, as well as a 20-year-old woman.

All were placed into custody while at home on Thursday morning in the London or the West Midlands region of England. Police seized multiple electronic devices.

NCA Deputy Director Paul Foster, head of the cybercrime unit, called the arrests “a significant step” in the investigation but said authorities continue to search for affiliates of the loose hacking collective known as Scattered Spider, responsible for ransomware and data theft incidents at M&S and the Co-op. Hackers also targeted Harrods. “Our work continues, alongside partners in the U.K. and overseas, to ensure those responsible are identified and brought to justice.”

The incidents resulted in disruptions including empty shelves in grocery stores and customers being unable to order online. High Street mainstay M&S estimates the attack will lead to 300 million pounds – about $407 million – in lost profits.

The loosely organized Scattered Spider collective emerged in mid-2022 and has been tied to attacks against well over 100 organizations based in the United States, the United Kingdom, Canada, India and beyond.

Notable past targets have included MGM Resorts, Clorox and potentially the cryptocurrency trading platform Coinbase Global.

Members of the group have regularly partnered with different ransomware operations, including Alphv, a.k.a. BlackCat, RansomHub, Qilin and lately DragonForce.

Following the April attacks against British retailers further victims of the group likely include Aflac, America’s largest provider of supplemental health insurance, as part of a campaign researchers see targeting U.S. insurers. More recently, the group also appears to have begun targeting the aviation sector (see: Scattered Spider Suspected in Qantas Data Breach).

Native-Speaking Social Engineers

Scattered Spider is known for tricking help desks using native English-speaking skills, running SIM-swap and phishing attacks, overwhelming targets with multifactor authentication push requests and demanding massive ransoms from victims.

Defending against Scattered Spider has been challenging because the group targets employees whose job it is to be helpful and available. “Their aggressive social engineering tactics and relentless pursuit of access have proven particularly challenging for many defenders and resulted in considerable damage to organizations in the U.K. and U.S.,” said Charles Carmakal, CTO of Google Cloud’s Mandiant Consulting.

Carmakal said previous arrests of alleged Scattered Spider members have caused “a significant lull in activity,” and that the Thursday arrests have likely created “a critical window for organizations to fortify their defenses.”

M&S chair Archie Norman, testifying Tuesday before the U.K. Parliament’s Business and Trade subcommittee on economic security, said the attackers breached the company’s network on April 17 through a social engineering attack before deploying crypto-locking malware from the DragonForce ransomware-as-a-service operation.

“It was sophisticated impersonation,” he said. “They didn’t just rock up and say ‘Would you change my password?,'” but rather appeared bearing the details of someone who should have legitimate access.

“Part of the point of entry in our case also involved a third party,” which “is just a reminder that that attack surface is very hard to defend,” he said.

Reuters reported in May the M&S hackers employed valid login credentials for two employees of Tata Consulting Services, based in Mumbai, which handles the British retailer’s digital operations across its supply chain, stores and merchandising.

Norman said he expects M&S to emerge largely unscathed, although not without short-term challenges. “Roughly speaking, for each week we were not trading online, we were losing 10 million pounds in profit. We are now up and running online, but we are not back to where we should be,” he said.

One challenge is that to respond to the incident, M&S was forced to take multiple systems offline. “I think you will find that Co-op did the same, and probably more radically than we did,” Norman said. “Once you have closed them down, however, bringing them back up in a safe form is very difficult.”

Wider Problems

Combating native English speakers adept at trickery remains challenging (see: Help Desk Hoax: How Attackers Bypass Tech Defenses).

“One key entry point for M&S is that unusually, fluent, unaccented – they did not sound foreign or second-language speakers – native English speakers deceived the help desk,” cybersecurity expert Ciaran Martin, a professor of practice at Oxford University, told the parliamentary committee on Tuesday, citing public reports about the attack.

“That is arguably preventable, but you can all understand the sort of tensions and trade-offs in how that happens,” he said. “Once they were in, it appears that the techniques used were very sophisticated, because they were looking like a normal user. It is sometimes called living off the land – you look absolutely normal. That can be very hard to detect.”

Martin, who served as the first head of Britain’s National Cyber Security Centre from 2016 to 2020, told lawmakers that the retail attacks highlight the nation’s vulnerability to cyberattacks, including by adversarial nation-states (see: Legacy Systems and Policies Expose West to Cyber Disruption).

“Criminals have given us a playbook here: you can disrupt an iconic British brand with some effort, but effort that is comfortably within the easy reach of adversaries,” he said. “What is also in easy reach of state adversaries is to do this on multiple occasions at the same time. That is the worry.”