Kevin BeaumontDragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks
I'm going to make this the new ongoing megathread for DragonForce Ransomware Cartel's attack on UK retailers as they're all connected.
Why it matters: these are some of the UK's largest retailers, think Target or some such in a US sense.
Prior threads
M&S: https://cyberplace.social/@GossiTheDog/114381946765071799
Co-op: https://cyberplace.social/@GossiTheDog/114426688834113446
Harrods:
https://cyberplace.social/@GossiTheDog/114433519351165250
Kevin Beaumont (@[email protected])
Marks and Spencer dealing with.. ransomware? https://infosec.exchange/@d4rkshell/114381922723370326
The individuals operating under the DragonForce banner are using social engineering for entry.
Defenders should urgently make sure they have read the CISA briefs on Scattered Spider and LAPSUS$ as it's a repeat of the 2022-2023 activity.
Links: https://www.cisa.gov/sites/default/files/2023-08/CSRB_Lapsus%24_508c.pdf
https://www.cisa.gov/sites/default/files/2023-11/aa23-320a_scattered_spider_0.pdf
I would also suggest these NCSC guides on incident management: https://www.ncsc.gov.uk/collection/incident-management
and effective cyber crisis comms: https://www.ncsc.gov.uk/guidance/effective-communications-in-a-cyber-incident
Co-op Group have now admitted a significant amount of member (customer) information has been stolen by DragonForce Ransomware Cartel, saying they "accessed data relating to a significant number of our current and past members" - around 20 million people. The Membership database, basically. That includes home addresses and phone numbers etc.
Up until now Co-op hadn't even used the words cyber or threat actor, referring to an "IT issue" and "third party" in comms.
New by me - breaking down the attacks on UK highstreet retailers
Regarding IOCs around the UK retailer activity - there’s loads doing the rounds, and they’re almost all not useful.
Eg hundreds of dynamic VPN IPs from 2022. If you google them you’ll find them on vendor blogs from years ago for Scattered Spider - people are recycling in panic and passing around in panic.
Don’t hunt on random IOCs. IP addresses change. Strengthen foundational controls. Review sign in logs for abnormal activity etc.
Bleeping Computer have more on the Co-op breach https://www.bleepingcomputer.com/news/security/co-op-confirms-data-theft-after-dragonforce-ransomware-claims-attack/
One of M&S’ biggest suppliers have said they have reverted to pen and paper for orders due to M&S lacking IT.
Additionally, M&S staff are raising concern about how they will be paid due to lack of IT systems.
M&S are over a week into a ransomware incident and still don’t have their online store working.
By the way, this is absolutely terrible advice for dealing with a major and high visibility ransomware incident.
There's a report on ITV News that Co-op member data is available on the Dark Web(tm), but as far as I know this isn't accurate. DragonForce's portal hasn't been available for over a week.
Here's the ITV News report anyhoo, logline: "ITV News understands the the ongoing cyberattack faced by the supermarket has worsened since Friday, impacting the ordering system, drivers and warehouse staff."
Sunday Times has a piece looking into ransomware incident at Marks and Spencer. It's pretty good, goes into their contain and eradicate focus.
"By shutting down parts of the IT estate, Higham’s team had worked to prevent the attack from spreading, but had also stopped parts of its digital operations from functioning. This was considered a worthy trade-off."
One error in the article - lack of recovery doesn't mean no ransomware paid. Paying is not quick restoration.
https://www.thetimes.com/business-money/companies/article/m-and-s-cyber-attack-ms-klrnxvwq6
A wrote a piece about paying ransoms does not equal quick restoration - in fact, quite often it makes things worse. https://doublepulsar.com/big-game-ransomware-the-myths-experts-tell-board-members-03d5e1d1c4b7
Great NCSC piece by @ollie_whitehouse
I’d add - block by Entra policy specifically High risk logins (below is too FP prone), and SOC monitor them. SOC playbook = account probably compromised. How?
https://www.ncsc.gov.uk/blog-post/incidents-impacting-retailers
Sky News quote a source in M&S head office saying Marks and Spencer have no ransomware incident plan so they are making it up as they go along apparently, with staff sleeping in the office and communicating via WhatsApp.
M&S dispute this, saying they have robust business continuity plans.
BBC News has a look at teenagers phoning helpdesks and pretending to be the CISO. https://www.bbc.com/news/articles/c4grn878712o
One of the points of exploitation of large orgs is they usually outsource their Service Desk to somewhere cheap offshore who don’t know the org staff, and when you call and say your name, they normally put big all caps bold red warning if the person is a VIP, eg C suite, so they get VIP service - ie anything goes.
Co-op Group appear to be trying to course correct with their cyber incident comms.
They’re calling it a cyber incident now, and have put a statement on the front page of their website, along with an FAQ. They haven’t yet emailed members (they should). Edit: they’ve started emailing members.
It sounds like the situation at Co-op has got worse. They’ve stopped taking card payments in some stores, it’s cash only. https://www.telegraph.co.uk/business/2025/05/06/co-op-shops-stop-taking-card-payments-amid-cyber-attack/
People are also taking to social media to post pictures of apparently emptying store shelves.
The Co-op website claims it is down to "technical issues".
Contactless payment has been fixed at all Co-op Group stores.
One thing for media covering the Co-op thing - attackers are not impersonating IT help desks to gain access. They’re impersonating *staff* calling in to the IT help desks - they’re different things.
Co-op Group are redirecting supplies from their urban stores to remote and island locations due to stock shortages.
The article mentions their EDI platform is suffering “technical issues”. https://www.retailgazette.co.uk/blog/2025/05/co-op-reroutes-stock/
I just did a Shodan Safari on Co-op - basically all their Windows and Linux systems in their core DCs at network boundary are down, it's not just EDI. It's been like that for just under a week, prior to that things were still online.
I feel really bad for them as it's a great org. Also their CEO is basically the only one who stood up like this for trans people.
https://www.telegraph.co.uk/business/2025/05/04/ill-protect-trans-people-to-the-end-vows-co-op-boss/
If you're wondering about Marks and Spencer - I just did a Shodan Safari of their network boundary, Palo-Alto GlobalProtect VPN remote access access is still offline, 15 days later.
Online orders are still not working, and the store stock checker is disabled now.
Co-op have paused all non-essential products in stores https://www.retailgazette.co.uk/blog/2025/05/co-op-non-essential/
Every detail in this article is wrong. The M&S incident had nothing to do with hybrid working.
Marks and Spencer’s online shopping is still offline 3 weeks later. It is thought they have lost around £63m so far, excluding IR, BCP and ransom payment costs. https://www.drapersonline.com/news/ms-online-shopping-outage-enters-third-week
M&S had a significant amount of data stolen btw, but they’ve opted not to tell customers or staff.
The Grocer reports 4 regional Co-ops, who aren’t part of Co-op Group, are suffering stock shortages as they are supplied by Co-op Group.
They expect customers to start to see availability issues on shelves in the coming days.
For orgs looking for defence tips for the attacks on UK retailers, this blog from 2022 about the UK teenagers in LAPSUS$ has relevance.
As a plot twist - not documented anywhere online, but LAPSUS$ first attacks in 2021 were against UK high street retailers.
DEV-0537 criminal actor targeting organizations for data exfiltration and destruction | Microsoft Security Blog
The activity we have observed has been attributed to a threat group that Microsoft tracks as DEV-0537, also known as LAPSUS$. DEV-0537 is known for using a pure extortion and destruction model without deploying ransomware payloads.
Interpipes 💙@GossiTheDog why do firms do this
Paul Chambers🚧@GossiTheDog Not sure if it is related, but M&S shuttered a flag-ship store without notice and earlier than planned on May 7th.
🔗 Marks and Spencer suddenly closes Aberdeen’s flagship St Nicholas branch after more than 80 years in city centre https://www.pressandjournal.co.uk/fp/news/aberdeen-aberdeenshire/6750909/marks-and-spencer-shuts-st-nicholas-branch/
Dave Dustin@GossiTheDog That value feels low or are M&S not huge online like other properties?
groff 🇺🇦@venzann @GossiTheDog
AFAIK M&S mainly sell online through Ocado (who they partly own), for food, and they've only had shortages of limited items. For clothing sales the vast majority of their customers still shop in store.
AFAIK M&S mainly sell online through Ocado (who they partly own), for food, and they've only had shortages of limited items. For clothing sales the vast majority of their customers still shop in store.
Ghostrunner@GossiTheDog ah yes, the new corollary to Rumsfeld's 'never let a crisis go to waste' - 'never miss an opportunity to lie to push your agenda'
Anthropy@GossiTheDog you don't understand, I lost at least 700 million to the drugs I had to buy to help my paranoia because I can't watch my wageslaves Imean workers do their job 
Frank Endrullat 🌻@GossiTheDog Meanwhile, some other organisations have learned how to implement zero trust properly. Yes, it’s sometimes annoying, but it does work pretty well overall. 🤷♂️
Simon ZerafaHow many of those who own that alleged newspaper own commercial property?
Neil Craig
ian
Landwomble@GossiTheDog the Co-op really do try to do the right thing. Glad I'm not working in Co-op Food IS any more but their social mission is pretty darn solid.
Tom DB 🦣@GossiTheDog Auwch, it helpdesk falling victim of social engineering.
Klaus Frank@GossiTheDog Ehm, they're doing both things. The easiest way to get physical access to most companies is to pretend being an employee of their it service contractor. They often just open all of the doors and show you the way right into the server room or ask you if they should log out before you take over (followed by if you'd like tea or coffee). At most what you as an attacker risk is getting also tasked with fixing the printer or copy machine "now that you're already here"...
Clemens Zauner@GossiTheDog Well, that's an easy one. Just say that you are calling regarding the reported problem with Outlook.
On the one hand you have a ~90% Chance, that the called person had.a Problem in the last Week, and on the other hand will hand you over the username as well as the password immediately.
I'm somewhat surprised, that this had not been tried earlier.
Andrej@czauner @GossiTheDog "I'm calling regarding your problem with Microsoft uhmm *garbled*... "
Geoffairey@GossiTheDog @daveW I don’t knwo about this case, but both things happen
C-rich@GossiTheDog I will go full Benicio Del Toro on the ransomware gang for many many millions of vegetables.
Phil Moss@GossiTheDog Signs for Cash Payment Only and many itemns out of stock at the coop I use this morning. I'll see if it is still the case tomorrow (most likely)
◄◄ ► █ ►►@GossiTheDog Local one is plentifully stocked despite Bank Hols.
There's always money in the Hawala stand. /s
MJ Ray@GossiTheDog I wonder how that's working in villages where the co-op or its Post Office is the only source of cash
Gary 
@GossiTheDog voluntarily, or has their card processing company got twitchy?
TheTomas@GossiTheDog oh Well BC (Business Continuity) seems not to be on their priority list at all? That's Interesting...
@GossiTheDog they've stopped taking cash payments today in my local one for first time
@GossiTheDog I got an email (as a member) at about 16:20 this afternoon on the subject
@WiteWulf @GossiTheDog but of course, any member with better IT security than the co-op isn't allowed to read it until they run random scripts from a company that just got hacked!
Tom@GossiTheDog noticed the shelves in my local Co-op were not looking good this evening. Looks like they are struggling getting items ordered via their fallback methods.
Elias Mårtenson@GossiTheDog interestingly enough, trying to folloy the link gave me this.
catatonicprime@GossiTheDog we have this VIP setting. However it is not used that way for us. We use it to track if you're an asshole. So it's more like the different color bands for cats at a shelter. This one is known to be aggressive, exercise extreme caution when engaging/escalate quickly to someone else who can.
NosirrahSec 🏴☠️ guillotine enthusiast@catatonicprime @GossiTheDog we hang up on users that get aggressive, etc.
Lol who the fuck is gonna sit there and take shit from anyone?
b̴̨h̷̢̨s̴̡̡̕͡ù̢á̴͘͠r͘͝e̛͠z̨̀
kwayk42@GossiTheDog I mean "lying about it and living in crisis mode" is a continuity plan right?
Chester Wisniewski 🇨🇦@GossiTheDog Let me guess, the robust plan is to make it up as they go along and keep systems down for at least a week?
Alesandro Ortiz 🇵🇷🏳️🌈@GossiTheDog Both can be true, I imagine?
wrosecrans@GossiTheDog This is basically the plan for most businesses in reality.
It's fine to talk about stuff being "widely known best practice," but when IT shows up with big expenses for backups and security, the MBA's always decide it's more important to rightsize the headcount and operate lean. Many IT departments report up through an MBA and not a technical person, and many IT people are terrible at communicating risk dramatically enough to get money.
Kevin Riggle@GossiTheDog What’s the Mike Tyson quote? “Everybody has a plan until they get punched in the face”?
Matt Palmer@GossiTheDog the business continuity plans are so robust they've been successfully stopping the CFO's desk from wobbling for the past fourteen years.
Jamie Dowling@GossiTheDog After watching hours of the COVID UK Inquiry and the Post Office Horizon Inquiry, anyone saying something is "robust" is lying to cover their ass.
Floating Onion@GossiTheDog If you don’t test it properly, it doesn’t count. See also failover and backups.
StaffSRE1138@GossiTheDog The thing that gets me is that the two statements are probably true for the people who said them. The Security group may have wargamed and prepared for malware attacks, and done so in a way that no one else in the technical stack even noticed happening (beyond some new agent installs being requested). So when the attack comes, the Security plan swings into action and no one outside of Security knows what it is or has practiced it.
This is high visibility. Executives step in to make Declarations, complicating the response. This is an incident big enough to need sub-commands to track various workflows, reporting up to a rotating incident command. Everyone wants to help, the workflows aren't well defined yet, and people help on their own authority (thanks to Command not having a clear picture yet and guiding where help would be good) and maybe make things worse in a few spots.
We had a plan.
It is chaos.
Both are true.
vampirdaddy@GossiTheDog @ollie_whitehouse
Do egress filtering (esp. for servers) with alerting.
If there is unknown communication, then you have either a misconfiguration or a problem.
Keep critical IT infrastructure (network, firewalls, SAN/NAS, virtualisation, backups) separated from Active Directory.
Do not couple internet-facing systems (including VPN and M365) with your local AD.
Brian Clark@GossiTheDog @ollie_whitehouse One Entra Conditional Access policy to block high risk logins, a second policy to block high risk users. You most likely want to do both, and need to do them in separate policies