Scattered Spider (also tracked as 0ktapus, UNC3944, Scatter Swine, Starfraud, and Muddled Libra) is a term used to describe a fluid collective of threat actors known for breaching many high-profile organizations worldwide in sophisticated social engineering attacks that also involve phishing, SIM swapping, multi-factor authentication (MFA) bombing (also known as targeted MFA fatigue). The DragonForce ransomware operation has claimed all three attacks, and BleepingComputer has learned that the attackers who orchestrated them have used the same social engineering tactics linked to Scattered Spider threat actors. "The US retail sector is currently being targeted in ransomware and extortion operations that we suspect are linked to UNC3944, also known as Scattered Spider," John Hultquist, Chief Analyst at Google Threat Intelligence Group, told BleepingComputer. Although news outlets and security researchers frequently use "Scattered Spider" to describe this collective as a cohesive gang, it refers to a loosely-knit group of threat actors who use specific tactics during their attacks, making it challenging to track their activities. As first reported by BleepingComputer, British retail giant Marks & Spencer (M&S) was first breached in a ransomware attack where threat actors encrypted virtual machines on VMware ESXi hosts with a DragonForce encryptor. Since Scattered Spider started targeting UK retailers in April, the UK National Cyber Security Centre (NCSC) has published guidance to help UK organizations strengthen their cybersecurity defenses and has also cautioned that these cyberattacks should be seen as a "wake-up call", as any of them could become the next target. Some Scattered Spider threat actors are also believed to be part of the "Com," a loosely connected community involved in cyberattacks and violent acts that have often attracted media attention. Google warned today that hackers using Scattered Spider tactics against retail chains in the United Kingdom have also started targeting retailers in the United States. Other attacks linked to Scattered Spider include those on Twilio, Coinbase, DoorDash, Caesars, MailChimp, Riot Games, and Reddit.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 14 May 2025 19:40:03 +0000