<![CDATA[DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks]]>DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks

https://cyberplace.social/system/media_attachments/files/114/439/291/680/282/586/original/e2f2cb46a87536b1.jpeg

]]>https://bbs.spacc.eu.org/new/topic/dc3d9707-fa57-4d41-b6ed-d9e961571854/dragonforce-ransomware-cartel-are-claiming-credit-for-attacks-on-marks-and-spencer-co-op-and-harrods-and-say-more-victim-orgs-are-coming-https-www.bloomberg.com-news-articles-2025-05-02-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacksRSS for NodeSun, 08 Nov 2026 20:14:29 GMTFri, 02 May 2025 16:56:56 GMT60<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Thu, 18 Sep 2025 18:42:57 GMT]]>What's also shocking from their arrest and appearance in court today and the US charges is the allegation businesses paid them 9 figures (!) in ransoms to avoid disclosure - the court was told today Thalha allegedly has $200m in cryptocurrency and Owen has $8m.

How is it normal businesses are funding that?

]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/115226770011901156https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/115226770011901156Thu, 18 Sep 2025 18:42:57 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Thu, 18 Sep 2025 18:36:55 GMT]]>Achievement unlocked for LAPSUS$, got a court drawing

Link Preview Image
]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/115226746246298905https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/115226746246298905Thu, 18 Sep 2025 18:36:55 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Thu, 18 Sep 2025 15:03:13 GMT]]>"In October 2024 and January 2025, Jubair participated in a scheme to gain unauthorized access to the networks of a U.S.-based critical infrastructure company and the U.S. Courts."

Related: not very stealthy, they posted screenshots of their access this week. 🤦‍♂️

Attention Required! | Cloudflare

favicon

(databreaches.net)

Link Preview Image
]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/115225905984180198https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/115225905984180198Thu, 18 Sep 2025 15:03:13 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Thu, 18 Sep 2025 14:59:00 GMT]]>For the record, since I think it's now safe to say - Thalha Jubair (a teen) is the key guy behind LAPSUS$/Scattered Spider/ShinyHunters and allegedly most of the big cyber incidents of the past 5 years.

He's been running rings around everybody since he was 14.

]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/115225889363574933https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/115225889363574933Thu, 18 Sep 2025 14:59:00 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Thu, 18 Sep 2025 14:56:19 GMT]]>Justice.gov are pissed at Thalha Jubair and have also charged him, he faces 95 years of jail in the US.

Link Preview Image
United Kingdom National Charged in Connection with Multiple Cyber Attacks, Including on Critical Infrastructure

A complaint filed in the District of New Jersey was unsealed today charging Thalha Jubair, a United Kingdom national, with conspiracies to commit computer fraud, wire fraud, and money laundering, in relation to at least 120 computer network intrusions and extortion involving 47 U.S. entities.

favicon

(www.justice.gov)

"From as early as May 2022 to as recently as September 2025, Jubair and his associates were involved in approximately 120 network intrusions, including accessing the computer networks of at least 47 U.S.-based victims. Collectively, victims paid more than $115 million to Jubair and his associates in efforts to recover their data and prevent its disclosure. "

]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/115225878804647740https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/115225878804647740Thu, 18 Sep 2025 14:56:19 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Thu, 18 Sep 2025 13:24:01 GMT]]>I believe this is the fourth time Thalha Jubair has been arrested btw.

]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/115225515894689331https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/115225515894689331Thu, 18 Sep 2025 13:24:01 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Thu, 18 Sep 2025 13:22:10 GMT]]>Suspect arrested for M&S hack have been rearrested (again), this time for Transport for London hack last year. Also charged for it: https://therecord.media/scattered-spider-teenage-suspects-arrested-britain-nca

]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/115225508600651821https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/115225508600651821Thu, 18 Sep 2025 13:22:10 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Mon, 15 Sep 2025 17:30:14 GMT]]>Marks and Spencer CTO leaves, CISO still in role.

It’s difficult to see what happened as her fault - eg the decision to outsource the frontline IT helpdesk that did the password resets dates 5 years before she joined.

Attention Required! | Cloudflare

favicon

(www.computerweekly.com)

]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/115209497106343076https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/115209497106343076Mon, 15 Sep 2025 17:30:14 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Mon, 11 Aug 2025 09:03:53 GMT]]>M&S still working on system recovery. https://www.bbc.com/news/articles/cewyyjdzql4o

]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/115009325207305703https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/115009325207305703Mon, 11 Aug 2025 09:03:53 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Mon, 11 Aug 2025 09:03:08 GMT]]>I understand the people released have not been charged.

]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/115009322287213707https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/115009322287213707Mon, 11 Aug 2025 09:03:08 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Thu, 17 Jul 2025 13:07:57 GMT]]>The people arrested as part of the Co-op and M&S hack investigation have been released on bail.

Link Preview Image
Four people bailed after arrests over cyber attacks on M&S, Co-op and Harrods

Four young people who were arrested for their suspected involvement in the damaging cyber attacks against Marks & Spencer, the Co-op and Harrods, have been bailed. The arrests on July 10 included a 17-year-old British man from the West Midlands, a 19-year-old Latvian man from the West Midlands, a 19-year-old British man from London, and […]

favicon

Nation.Cymru (nation.cymru)

Previously when this happened with LAPSUS$, they just continued hacking stuff.

]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114868727136140006https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114868727136140006Thu, 17 Jul 2025 13:07:57 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Wed, 16 Jul 2025 08:58:23 GMT]]>Personally I think Co-op did a really good job getting out of that situation and minimising impact.

I definitely think if you have a LAPSUS$ style advanced persistent teenagers situation, tilt towards open and honest comms as those kids will use secrecy against ya. It’s 2025, it’s okay to say you got hacked, people largely understand. Also, in IR, lawyers are usually stuck in 1980 advice - it’s just advice, they ain’t yo boss.

]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114862083533933504https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114862083533933504Wed, 16 Jul 2025 08:58:23 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Wed, 16 Jul 2025 08:47:29 GMT]]>Co-op finally admitted the entire membership database was stolen

I had this in the thread months ago, they originally tried to deny it entirely then tried to say ‘some’ data was accessed when they knew it was the whole thing.

Link Preview Image
Co-op boss says sorry to 6.5m people who had data stolen in hack

In her first interview since the attack, Co-op's chief executive said she was "incredibly sorry" to customers.

favicon

BBC News (www.bbc.co.uk)

]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114862040639425672https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114862040639425672Wed, 16 Jul 2025 08:47:29 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Thu, 10 Jul 2025 21:07:55 GMT]]>. @briankrebs has broken the story that the key member (and teenager) of LAPSUS$ runs Scattered Spider

Link Preview Image
UK Arrests Four in ‘Scattered Spider’ Ransom Group – Krebs on Security

favicon

(krebsonsecurity.com)

Link Preview Image
]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114830978256559928https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114830978256559928Thu, 10 Jul 2025 21:07:55 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Thu, 10 Jul 2025 17:10:53 GMT]]>After almost 3 months, Marks and Spencer recruitment system came back online just now. First 4 jobs posted.

Link Preview Image
]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114830046234787386https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114830046234787386Thu, 10 Jul 2025 17:10:53 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Thu, 10 Jul 2025 16:58:28 GMT]]>If you ever doubted the link between Scattered Spider(tm) and LAPSUS$ - one of the people arrested today was a key part of the LAPSUS$ attacks a few years ago.

]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114829997395413113https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114829997395413113Thu, 10 Jul 2025 16:58:28 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Thu, 10 Jul 2025 11:17:17 GMT]]>17 and two 19 year old teens picked up over Co-op and M&S hacks, and a 20 year old woman.

Pretend to be surprised.

Link Preview Image
Four arrested in connection with M&S and Co-op cyber attacks

Three men and one woman - aged between 17 and 20 - have been arrested in London and the Midlands.

favicon

(www.bbc.com)

]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114828655814248826https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114828655814248826Thu, 10 Jul 2025 11:17:17 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Tue, 01 Jul 2025 12:56:48 GMT]]>Marks and Spencer’s CEO says half of their online ordering is still offline after their ransomware incident, they hope to get open in next 4 weeks.

They are also rebuilding internal systems and hope a majority of that will be done by August.

Lesson: mass contain early. M&S didn’t. Co-op did.

reuters.com

favicon

(www.reuters.com)

]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114778086324014184https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114778086324014184Tue, 01 Jul 2025 12:56:48 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Fri, 27 Jun 2025 13:43:51 GMT]]>Ultra spicy post claiming to be from UK retailer employee (M&S or Co-op) about their experience with TCS on their security incident. https://www.reddit.com/r/cybersecurity/comments/1ll1l6c/scattered_spider_tcs_blame_avoidance/?utm_source=share&utm_medium=mweb3x&utm_name=mweb3xcss&utm_term=1&utm_content=share_button

Link Preview ImageLink Preview ImageLink Preview Image
]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114755622102325261https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114755622102325261Fri, 27 Jun 2025 13:43:51 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Tue, 24 Jun 2025 21:13:24 GMT]]>Latest Marks and Spencer update is pretty crazy.

M&S haven't been able to supply sales data - so the British Retail Consortium (BRC) - used by the UK government as as economic indicator - basically made up figures for M&S and didn't tell people they had done this.

https://www.telegraph.co.uk/business/2025/06/24/retail-lobby-group-accused-of-ms-cyber-cover-up/

]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114740402889446177https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114740402889446177Tue, 24 Jun 2025 21:13:24 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Sat, 21 Jun 2025 20:17:20 GMT]]>TCS have told shareholders their systems were not compromised in the hack of M&S.

As an explainer here (not in the article): TCS IT systems weren't compromised. Their helpdesk service (they're AD admins at M&S) was used to gain access to M&S. They manage M&S IT systems.
https://www.reuters.com/business/media-telecom/indias-tcs-says-none-its-systems-were-compromised-ms-hack-2025-06-19/

]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114723195478277561https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114723195478277561Sat, 21 Jun 2025 20:17:20 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Fri, 20 Jun 2025 13:11:37 GMT]]>M&S still have no recruitment system, two months in.

https://cyberplace.social/system/media_attachments/files/114/715/858/648/704/571/original/c8eebc6eecd2a6ae.png

]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114715859195707257https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114715859195707257Fri, 20 Jun 2025 13:11:37 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Tue, 10 Jun 2025 08:56:20 GMT]]>Marks and Spencer have started partial online shopping again.

For statto nerds, around 7 weeks from containment to partial recovery

https://www.bbc.co.uk/news/articles/c4gevk2x03go

]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114658232249871993https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114658232249871993Tue, 10 Jun 2025 08:56:20 GMT<![CDATA[Reply to DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks on Fri, 06 Jun 2025 06:57:33 GMT]]>M&S had their ransomware incident communicated via internal email - from the account of a staff member who works for TCS.

The way TCS work is you give them accounts on your AD.

https://www.bbc.co.uk/news/articles/cr58pqjlnjlo

]]>https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114635115966733939https://bbs.spacc.eu.org/new/post/https://cyberplace.social/users/GossiTheDog/statuses/114635115966733939Fri, 06 Jun 2025 06:57:33 GMT