The UK’s National Cyber Security Centre has urged all retailers to strengthen their cybersecurity measures and advised consumers to monitor banking activities and update passwords. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. These attacks have caused significant operational disruptions and financial losses, marking one of the most substantial cyber campaigns against British retail in recent history. As these attacks continue to unfold, they serve as a stark reminder of the evolving threat landscape and the critical importance of robust cybersecurity practices for all organizations, particularly those handling sensitive customer data. Internal communications revealed Co-op employees were instructed to keep cameras active during Teams meetings and verify participant identities, suggesting attackers had breached internal communication channels. This move positions DragonForce as a “Ransomware Cartel,” providing infrastructure and malware while affiliates conduct operations. Kaaviya is a Security Editor and fellow reporter with Cyber Security News. The attackers deployed the DragonForce encryptor against M&S’s VMware ESXi hosts, encrypting virtual machines supporting e-commerce and payment processing systems. The Co-op Group confirmed on May 2nd that hackers had accessed and extracted customer data, including names and contact information of Co-op members. Harrods announced on May 1st that its systems had also been targeted, though the luxury retailer acted swiftly to contain the breach, limiting internet access at its locations as a precautionary measure. In early 2025, DragonForce introduced a “white-label” service allowing affiliates to disguise attacks under different ransomware brands. The group’s ransomware uses strong encryption algorithms including AES-256 and RSA, with newer variants employing the ChaCha8 algorithm for faster encryption. She is covering various cyber security incidents happening in the Cyber Space. The malware attempts to escalate access to SYSTEM-level by exploiting Access Token Manipulation, using DuplicateTokenEx() and CreateProcessWithTokenW() functions. The group has been linked to exploiting several CVEs, including the notorious Log4Shell vulnerability (CVE-2021-44228). This led to a five-day suspension of online sales, resulting in estimated daily losses of £3.8 million and a market value drop exceeding £500 million.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 06 May 2025 13:30:18 +0000