Retail Sector in Scattered Spider Crosshairs

The teenage hackers behind Scattered Spider tend to launch attacks in waves against specific sectors – and it may be the retail sector’s turn.

See Also: Strengthening Your Security Program With Open API

High street British mainstays Marks & Spencer, Co-op and Harrods have recently felt a wave of incidents that in multiple cases show the hallmarks of a Scattered Spider attack (see: Scattered Spider Linked to Marks & Spencer Hack).

Google Mandiant on Tuesday said retail organizations accounted for 11% of victims listed on cybercrime data leak sites, up from 8.5% in 2024 and 6% in 2023.

Scattered Spider, which emerged in mid-2022 from a cybercrime community of juvenile hackers that calls itself “The Community,” aka the Com, has collectively attacked at least 130 companies – including MGM Resorts, Clorox and potentially the cryptocurrency trading platform Coinbase Global. Law enforcement in 2024 moved against several of its senior members, resulting in arrests and indictments.

“We have regularly observed UNC3944 conduct waves of targeting against a specific sector, such as financial services organizations in late 2023 and food services in May 2024,” Mandiant wrote in a Tuesday blog post. The group it tracks as UNC3944 overlaps with Scattered Spider.

“It is plausible that threat actors view retail organizations as attractive targets, given that they typically possess large quantities of personally identifiable information and financial data,” Mandiant said. “Further, these companies may be more likely to pay a ransom demand if a ransomware attack impacts their ability to process financial transactions.”

Scattered Spider may have deployed DragonForce ransomware strain on the Marks & Spencer VMware ESXi server. British consumer retailer Co-op took down its online ordering system after DragonForce reportedly breached its systems.

DragonForce’s relationship with Scattered Spider is not entirely clear. DragonForce operators have claimed control of RansomHub, a ransomware-as-a-service operation that apparently ceased operations in March. Scattered Spider was a RansomHub affiliate. DragonForce earlier this year announced a shift under which it provides infrastructure and tools such ransom negotiation but allows hackers to hack under their own brand and use whatever malicious encrypter they want, cybersecurity firm Sophos reported in April.

Scattered Spider could recover from the dent left in it by law enforcement, Mandiant said. “UNC3944’s existing ties to a broader community of threat actors could potentially help them recover from law enforcement actions more quickly.”

The group has relied on social engineering tricks such as SIM-swapping and phishing attacks to target its customers, leading Mandiant to recommend that help desks should positively identify employees before providing security information. “Avoid reliance on publicly available personal data for verification as UNC3944 often possesses this information. Use internal-only knowledge or real-time presence verification when possible,” the company said.

Companies should not rely on SMS messages or phone calls as a form of multifactor authentication. They should also decouple identity stores such as Active Directory form infrastructure platforms, it said.