NCA Investigates Cyberattacks on UK Retailers Linked to Scattered Spiders | Hacking

The hacker group referred to as the Scattered Spiders is a major focus in criminal investigations concerning cyberattacks against UK retailers, including Marks & Spencer, according to detectives.

The Scattered Spiders, a loosely organized collective of native English-speaking cybercriminals, have been strongly associated with hacking incidents involving M&S, cooperatives, and Harrods. M&S announced on Wednesday that it anticipates a financial impact of approximately £300 million following the recent system breach.

The UK’s National Crime Agency, tasked with combating cybercrime, stated that investigating this group is a priority.

“We are aware of groups publicly identified as Scattered Spiders, yet we maintain various theories as we pursue the evidence to identify the perpetrator,” I informed the BBC.

He added: “Given the extent of the damage we’re witnessing, apprehending the individual responsible for these attacks is our foremost objective.”

Last week, Google informed the Guardian that its UK-based members of the Scattered Spiders were actively “promoting” cyberattacks and warned the US that efforts to infiltrate the UK retailers’ systems were being mirrored in the US.

Targeting specific industries and locations is a common strategy among the Scattered Spider community, who utilize platforms like Discord and Telegram for communication.

Hackers affiliated with M&S deploy ransomware or malicious software that encrypts targeted files. This type of cybercrime is typically associated with Russian-speaking gangs, rather than native English speakers from the UK or the US.

“We are aware that Scattered Spiders predominantly communicate in English, but this does not necessarily imply that they are located in the UK. They engage in online discussions across a variety of platforms and channels.”

Reportedly, these hackers have utilized ransomware known as Dragon Force in their operations, functioning as a ransomware as a service that leverages another group of malware and infrastructure to distribute financial gains from attacks. Ransomware attackers generally request payment in cryptocurrency to unlock encrypted files and return stolen data.

Insights into the suspected Scattered Spiders can be found in a report from the US Department of Justice, which charged five individuals last year for targeting an unnamed American company through a “phishing” text message.

All defendants were in their twenties at the time of the allegations, with ages ranging from 20 to 25. Among them was Tyler Buchanan, 23, hailing from Scotland, who was extradited from Spain to the US.

Google also mentioned that “younger members” of the network often carry out various tasks, such as calling the company’s IT help desk or impersonating employees or contractors to gain access to computer systems. A former teenage hacker cited by the BBC remarked that it “would not surprise me” if a teenage hacker was behind a retail attack.