- Marks & Spencer suffered a cyber-incident earlier in April
- The media says the attack was the work of scattered pider
- The dealer still tackles downtime
The biggest cyber accident of British retailer Marks & Spencer, who has been running for more than a week now, seems to be the work of scattered spider, a notorious and smooth threat actor. The news was broken off Bleeping computerWith reference to “multiple sources” and claim that this was a ransomware attack. However, the company itself did not want to comment on the information.
At the end of April, news of a “cyber event” that affected M&S stores broke out in “Days” and resulted in “small changes” to save operations. The company also confirmed clicks and collection of services was affected and that some stores were unable to process contactless payments.
A few days later, the company said it had to take some systems and processes offline and that clicking and collecting services had to be paused in all stores. Online orders were also stopped as a result.
Old actors or new copycats?
The dealer said in a statement that to protect colleagues, partners, suppliers and business “made the proactive decision to move some [of our] Processes Offline ”. There were no affirmations that this was a ransomware attack, though it all pointed out that it was the case.
Now, Bleeping computer Says this was actually a ransomware attack, done by none other than scattered spider. This is not a state -sponsored threat actor, but rather an economically motivated collective. It is usually aimed at companies in the West, such as tech companies, Telcos and those who work in hospitality. The group breaks into networking through social engineering tactics and SIM-SWAPPING.
In previous years, it used to implement the Blackcat/Alphv Ransomware variant, but when this group was dissolved and disappeared, it turned to other solutions. In this case, the publication says the implemented Dragonforce encryption to M&S ‘VMware ESXI hosts on April 24 and encrypted virtual machines. Dragonforce has recently turned to a ‘cartel’ business model.
Several cyber security teams have been brought in to investigate and help mitigate the damage, including crowdstrike, Microsoft and Fenix24.
Via Bleeping computer
