Login
iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
Powered by MOMENTUMMEDIA
Google has said that retailers in the United States are next in the firing line following the wave of cyber attacks on UK retailers.
The US tech giant has said that the hackers behind the cyber attacks on Marks & Spencer (M&S), Co-op and Harrods are now taking aim at similar organisations in the US.
“US retailers should take note. These actors are aggressive, creative, and particularly effective at circumventing mature security programs,” said Google cyber security analyst John Hultquist.
Google has concluded that the threat actor in question is a group linked to the Scattered Spider hacking collective, which Microsoft, CrowdStrike and Fenix24 concluded was behind the cyber incidents during an investigation for M&S.
However, the general consensus is that the DragonForce ransomware gang is behind all three retailer attacks, having claimed all three and industry analysts making the same conclusion.
According to reports by the BBC, all three incidents have been claimed by the DragonForce ransomware gang, a claim that is backed by signs of their malware and more. Additionally, US cyber firm SentinelOne has also attributed the incidents to DragonForce.
“The DragonForce ransomware group has been targeting UK retailers in a series of coordinated attacks causing major service disruptions,” said Sentinel One.
“Prominent retailers such as Harrods, Marks & Spencer, and the Co-op have all reported ongoing incidents affecting payment systems, inventory, payroll and other critical business functions.”
What the M&S investigation did note is that the Scattered Spider hackers, who they believed to be behind the attacks, used DragonForce ransomware for the attacks, and that there is a relationship between the two groups.
This may suggest that DragonForce is behind the incident, or that Scattered Spider is part of DragonForce’s new “partner” program, which is similar to ransomware-as-a-service (RaaS) affiliate programs where affiliates use the infrastructure, but instead the partner uses their own branding, identity and operations.
Be the first to hear the latest developments in the cyber industry.
