https://www.bleepingcomputer.com/news/security/marks-and-spencer-breach-linked-to-scattered-spider-ransomware-attack/ – Marks & Spencer breach linked to Scattered Spider ransomware attack
Ongoing outages at British retail giant Marks & Spencer are caused by a ransomware attack believed to be conducted by a hacking collective known as “Scattered Spider” BleepingComputer has learned from multiple sources. … BleepingComputer has now learned that the ongoing outages are caused by a ransomware attack that encrypted the company’s servers. The threat actors are believed to have first breached M&S as early as February, when they reportedly stole the Windows domain’s NTDS.dit file. An NTDS.dit file is the main database for Active Directory Services running on a Windows domain controller. This file contains the password hashes for Windows accounts, which can be extracted by threat actors and cracked offline to gain access to associated plain-text passwords. Using these credentials, a threat actor can then laterally spread throughout the Windows domain, while stealing data from network devices and servers. Sources told BleepingComputer that the threat actors ultimately deployed the DragonForce encryptor to VMware ESXi hosts on April 24th to encrypt virtual machines. …
Regards