The hacker group Scattered Spider has expanded its focus to UK retail organizations, using advanced supply chain attacks to breach high-value targets.
Active since May 2022, the financially motivated group has shifted from targeting telecom and outsourcing sectors to industries like critical infrastructure and retail. These attacks often coincide with peak retail seasons to increase financial pressure on victims.
From Phishing to Cloud Exploitation
Scattered Spider, also known as Roasting Oktapus and Scatter Swine, is known for its social engineering expertise. Their methods include SMS phishing, SIM swapping, and MFA fatigue attacks. They collect employee phone numbers from public data sources and send phishing messages posing as IT staff to steal credentials.
Partnership with Ransomware Operators
In 2023, researchers observed Scattered Spider working with the BlackCat (ALPHV) ransomware group. Since then, they have deployed ransomware on Windows and Linux systems, especially VMware ESXi servers. Experts believe the group now collaborates with Russian-speaking ransomware networks but avoids targeting CIS countries.
Multi-Stage Attack Pattern
Their attacks follow a clear pattern:
- Phishing for initial access.
- Using remote management tools for persistence.
- Data theft and ransomware deployment.
Recent intrusions in the UK retail sector match Scattered Spider’s known tactics, though the group has not officially claimed responsibility. Analysts believe they now act as access brokers within affiliate models, making their involvement likely.
Advanced Security Evasion Tools
Scattered Spider uses powerful tools like POORTRY, a malicious driver that disables EDR security software. This driver exploits CVE-2015-2291, an old Intel vulnerability, and is signed with legitimate Microsoft certificates to avoid detection.
Supporting this is STONESTOP, a utility that installs and controls POORTRY, helping attackers maintain access while staying hidden.
Conclusion
Scattered Spider’s shift to UK retail targets highlights a dangerous evolution in supply chain attacks. Their advanced evasion techniques and ransomware partnerships pose serious risks to critical industries.
