Scattered Spider's Siege on Retail: A Wake-Up Call for Cybersecurity

By Kike Gandia · Threats · 4 min read

Scattered Spider's Siege on Retail: A Wake-Up Call for Cybersecurity

The cybercrime landscape is evolving at breakneck speed, and few groups show it as clearly as Scattered Spider. Known for its brazen social engineering tactics and relentless attacks, this cybercrime gang recently set its sights on major retailers in the UK and the US, leaving a trail of disruption behind it… and an urgent reminder of why robust cybersecurity matters. From Marks & Spencer to a large US retail chain, Scattered Spider's latest moves — detailed in a recent report by The Register — underline how sophisticated the group is and how pressing it is for organizations to shore up their defenses.

The Scattered Spider threat

Scattered Spider, also tracked as UNC3944 or Octo Tempest, is no ordinary cybercrime group. Made up of young English-speaking hackers, mainly from the United States and the United Kingdom, it operates within a broader community known as the Com. Since emerging in 2022, the group has built a reputation for its ingenuity, speed and ability to stay under the radar. It has already been linked to high-profile attacks on MGM Resorts, Caesars Entertainment and, more recently, the retail sector.

Its weapon of choice: social engineering. In one telling case, Jon DiMaggio, a former NSA analyst, listened in as a member of the group impersonated a real employee of a US retail chain. With an alarming level of detail — corporate email, hire date, employee ID and even a credible phone number — the impostor easily fooled the person on the other end of the line. “Those guys are good,” DiMaggio admitted. Prior access to sensitive information, most likely harvested in earlier attacks, makes their operations almost impossible to detect.

2022
year the group emerged (also known as UNC3944 or Octo Tempest)
US and UK
where its members come from (young English speakers from the “Com” community)
5
charged by the Department of Justice (November 2024)

Retail under siege

Retail has become the new battleground. In the UK, Marks & Spencer was hit by a ransomware attack using the DragonForce strain, which crippled key parts of its infrastructure. Co-op, another heavyweight of British retail, managed to avert disaster by taking its systems offline as a precaution. “We took early and decisive action to restrict access,” a spokesperson for the chain said, highlighting speed as the deciding factor. Even Harrods reported an attempted intrusion, marking a systematic escalation of attacks against British retail.

United Kingdom Marks & Spencer
Hit by a ransomware attack using the DragonForce strain, which crippled key parts of its infrastructure.
United Kingdom Co-op
Averted disaster by taking its systems offline as a precaution. “We took early and decisive action to restrict access,” a spokesperson said.
United Kingdom Harrods
Reported an attempted intrusion.
United States A large retail organization
With an elite security team made up of former intelligence analysts and law enforcement agents. That experience was crucial in thwarting the attack.

The known targets of the campaign against retail. Not every company has the luxury of a team like that.

In the United States, the threat persists. Although no names have been disclosed, the descriptions point to industry giants. DiMaggio describes one of the targets as “a large retail organization” with an elite security team made up of former intelligence analysts and law enforcement agents. That experience was crucial in thwarting the attack, but not every company has that luxury. As Charles Carmakal, CTO of Mandiant, warned: “They're resourceful, they're smart, they're fast.” Their strategy: generate such a flood of alerts (password resets, tools, suspicious activity) that even the best-prepared defenders are paralyzed.

Tactics that outpace defenders

Scattered Spider's modus operandi looks more like a military operation than a run-of-the-mill cyberattack. The group exploits known vulnerabilities such as CVE-2015-2291, eavesdrops on internal communications on platforms like Slack, and has even joined crisis calls during incidents. It has teamed up with ransomware groups such as ALPHV/BlackCat, amplifying its impact and gaining notoriety in the world of organized digital crime.

The FBI has documented a rap sheet of its techniques: phishing, SIM swapping, MFA fatigue attacks and help-desk impersonation. Combined with extensive inside knowledge of the target organizations, these tactics let the group get around conventional defenses. “You know they're attacking when the help desk gets a wave of password reset calls,” Carmakal explained. Faced with that volume, some response teams simply choose to take systems offline, preventing the damage but disrupting operations.

The techniques documented by the FBI how they get in

  • Phishing.
  • SIM swapping.
  • MFA fatigue attacks.
  • Help-desk impersonation.

What makes them work why they are hard to stop

  • Genuine inside knowledge: corporate email, hire date, employee ID.
  • Exploitation of known vulnerabilities such as CVE-2015-2291.
  • Eavesdropping on internal communications on platforms like Slack.
  • Infiltrating the crisis calls themselves during the incident.

Fighting back: law enforcement and organizational resilience

The authorities have not been sitting on their hands. In November 2024, the US Department of Justice charged five members of the group over attacks that stole millions in cryptocurrency. Among those arrested: Tyler Buchanan, 23, extradited from Spain. Another arrest involved a 17-year-old in the UK, although that case is still ongoing.

This progress matters, but the group's decentralized structure and its collaborative culture within “the Com” make it hard to dismantle for good. In the meantime, organizations are learning to adapt. Co-op's proactive response and the defense orchestrated by the expert team in the US show that preparedness, vigilance and operational agility remain our best weapons.

But not every company has the same resources. It is imperative that even SMBs put in place:

The sign that the attack is already under way. “You know they're attacking when the help desk gets a wave of password reset calls,” explains Charles Carmakal, CTO of Mandiant. The strategy is to generate such a flood of alerts that even the best-prepared defenders are paralyzed.

  • Social engineering awareness programs.
  • Advanced endpoint detection (EDR/XDR) solutions.
  • Up-to-date incident response plans.
  • Direct collaboration with threat intelligence providers.

A call to action for retail and beyond

Scattered Spider's siege is a wake-up call for every sector. Its ability to adapt, persist and operate with near-insider knowledge demands an immediate evolution in corporate defenses. Retailers and other organizations cannot afford to treat cybersecurity as just another cost: it is a strategic investment that protects data, reputation and operations.

At QuantumSec, we believe digital resilience is not optional. The cost of prevention is negligible compared with the cost of recovery. And while Scattered Spider is a formidable threat, it is also an opportunity to strengthen our foundations. With determination, collaboration and a clear vision, it is possible to tip the balance back even against adversaries of this caliber.

To learn more about protecting your organization against advanced cyber threats, follow the QuantumSec blog and join our upcoming specialist webinars.

Sources:

Related service

Penetration testing and ethical hacking services

Topics

#News #Cybersecurity #Scattered

Keep reading

Assess our exposure