Ongoing outages at British retail big Marks & Spencer are attributable to a ransomware assault believed to be carried out by a hacking collective referred to as “Scattered Spider” BleepingComputer has discovered from a number of sources.
Marks & Spencer (M&S) is a British multinational retailer that employs 64,000 staff and sells varied merchandise, together with clothes, meals, and residential items in over 1,400 shops worldwide.
Final Tuesday, M&S confirmed it suffered a cyberattack that prompted widespread disruption, together with to its contactless fee system and on-line ordering. Right this moment, Sky Information reported that the disruption continues, with round 200 warehouse employees informed to remain house as the corporate responds to the assault.
BleepingComputer has now discovered that the continued outages are attributable to a ransomware assault that encrypted the corporate’s servers.
The risk actors are believed to have first breached M&S as early as February, after they reportedly stole the Home windows area’s NTDS.dit file.
An NTDS.dit file is the primary database for Lively Listing Providers operating on a Home windows area controller. This file comprises the password hashes for Home windows accounts, which will be extracted by risk actors and cracked offline to achieve entry to related plain-text passwords.
Utilizing these credentials, a risk actor can then laterally unfold all through the Home windows area, whereas stealing knowledge from community gadgets and servers.
Sources informed BleepingComputer that the risk actors finally deployed the DragonForce encryptor to VMware ESXi hosts on April twenty fourth to encrypt digital machines.
BleepingComputer has discovered that Marks and Spencer requested for assist from CrowdStrike, Microsoft, and Fenix24 to examine and reply to the assault.
The investigation thus far signifies that the hacking collective referred to as Scattered Spider, or as Microsoft calls them, Octo Tempest, is behind the assault.
When contacted with this info, M&S mentioned that they might not go into particulars in regards to the cyber incident.
Do you’ve gotten details about this or one other cyberattack? If you wish to share the data, you’ll be able to contact us securely and confidentially on Sign at LawrenceA.11, through electronic mail at lawrence.abrams@bleepingcomputer.com, or by utilizing our suggestions type.
Who’s Scattered Spider?
Scattered Spider, also referred to as 0ktapus, Starfraud, UNC3944, Scatter Swine, Octo Tempest, and Muddled Libra, is a bunch of risk actors which are adept at utilizing social engineering assaults, phishing, multi-factor authentication (MFA) bombing (focused MFA fatigue), and SIM swapping to achieve preliminary community entry on massive organizations.
The group consists of younger English-speaking members (as younger as 16) with various ability units who frequent the identical hacker boards, Telegram channels, and Discord servers. These mediums are then used to plan and conduct assaults in actual time.
Some members are believed to be a part of the “Comm” – a loose-knit neighborhood concerned in violent acts and cyber incidents which have gained large media consideration.
Whereas the media and researchers generally discuss with Scattered Spider as a cohesive gang, they’re truly a community of people, with totally different risk actors taking part in every assault. This fluid construction is what makes it troublesome to trace them.
The group initially began in monetary fraud and social media hacks however later superior to extraordinarily refined social engineering assaults to steal cryptocurrency from people or breach firms in extortion assaults.
The group escalated its assaults in September 2023 after they breached MGM Resorts using a social engineering assault impersonating an worker when calling the corporate’s IT assist desk. On this assault, the risk actors deployed the BlackCat ransomware to encrypt greater than 100 VMware ESXi hypervisors.
This was a pivotal second within the ransomware panorama because it was the primary recognized indication that English-speaking risk actors had been working with Russian-speaking ransomware gangs.
Since then, Scattered Spider has been recognized to behave as associates for RansomHub, Qilin, and now DragonForce.
DragonForce is a ransomware operation that launched in December 2023, and has lately begun selling a brand new service the place they permit cybercrime groups to white-label their companies.
Researchers generally affiliate assaults with the Scattered Spider group based mostly on particular indicators of compromise, together with credential-stealing phishing assaults concentrating on SSO platforms, social engineering assaults impersonating IT assist desktop, and different techniques.
Cybersecurity agency Silent Push launched a report earlier this month outlining Scattered Spider’s most up-to-date phishing assaults.
Over the previous two years, regulation enforcement has been more and more concentrating on the group, arresting a number of alleged members in the US, the United Kingdom, and Spain.
