Threat analysis by The RabitaNoor (RBTN) Cyber Research Center
Scattered Spider Cyberattacks on UK Retailers M&S and Co-op
The goals of this document is to provide technical and strategic analysis of a much larger document, audio etc.
The document is a product of the RBTN - CYOI Pulpit
Photo by Yeshi Kangrang
Document Summary
The article discusses cyberattacks on UK retailers Marks & Spencer and Co-op in April 2025, attributed to the cybercrime group Scattered Spider, also known as UNC3944. The attacks, classified as a single combined cyber event by the Cyber Monitoring Centre, caused financial damages estimated between £270 million and £440 million. The initial access vector involved social engineering tactics targeting IT help desks. The article also mentions the potential involvement of Tata Consultancy Services and highlights the threat to the insurance sector in the US. The Qilin ransomware operation's new strategy of offering legal assistance during ransom negotiations is also noted.
Analysis
Overview
Timestamp: 2025-06-21
Title: Scattered Spider Cyberattacks on UK Retailers M&S and Co-op
Severity: High
The cyberattack on Marks & Spencer and Co-op was attributed to Scattered Spider, a sophisticated group known for social engineering. The attack leveraged impersonation tactics to gain access to IT help desks, causing significant financial damage. The infrastructure details remain unclear, but the impact on the retail sector was profound.
Adversary
Adversary: Scattered Spider, also known as UNC3944, is a cybercrime group known for advanced social engineering attacks.
Motivation: Financial gain through cyberattacks on retail and insurance sectors.
Sophistication: High, leveraging English-speaking members for social engineering.
TTPs:
- Social engineering
- Impersonation of IT department members
Capability
Capability: Scattered Spider employs social engineering tactics to gain unauthorized access.
Tools: Social engineering techniques
Evasion: Impersonation
Infrastructure
Description: No specific infrastructure details provided.
Victim Profile
Targets: UK retailers Marks & Spencer and Co-op were targeted.
Industry: Retail
Assets: IT help desks
Data at Risk: Financial data
Impact: High, with significant financial damages