Loading story…
Recent cyberattacks on major UK firms such as Marks & Spencer, Co-op, Harrods, and Jaguar Land Rover have been linked to the Scattered Spider group, not Russian state actors. The UK's National Crime Agency arrested four suspects, primarily from the UK and Latvia, believed to be part of this English-speaking social engineering crew. Security researchers and law enforcement emphasize that Scattered Spider operates as a criminal gang, not a Kremlin-backed entity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The Register reported Kaspersky's finding that the RevengeHotels threat campaign had returned, this time using AI-coded malware. The event is the public disclosure of the campaign's re-emergence and updated tooling.
The Register reported that UK chancellor Rachel Reeves publicly blamed Russia for recent cyber-related chaos, while noting that available evidence did not clearly support that attribution. This is a distinct public attribution event reflected in the coverage.
SC Media reported that the Kawa4096 ransomware gang had begun a broad campaign affecting victims globally. The reference indicates an active ransomware operation but provides no additional dated milestones beyond the report itself.
4 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcetheregister.com
Open sourcego.theregister.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
UK law enforcement is facing increased pressure from the simultaneous rise of young, English-speaking hackers such as those associated with 'Scattered Spider' and the continued threat from organized Russian-speaking ransomware groups. These new threat actors, often motivated by prestige and recruited from online communities, have been implicated in high-profile attacks on UK retailers, resulting in significant financial losses and straining the resources of authorities already challenged by budget constraints and evolving technology. The operational differences between these groups—Scattered Spider's focus on social engineering and the Russian-speaking groups' technical sophistication—are creating a complex threat landscape for the UK. Concurrently, a new phishing kit named 'Spiderman' has emerged, enabling cybercriminals to launch sophisticated phishing campaigns against dozens of European banks and cryptocurrency services. The kit allows attackers to create convincing replicas of legitimate banking and fintech sites, capture credentials and two-factor authentication codes, and even steal cryptocurrency wallet seed phrases. Its modular design and real-time control panel features make it a popular tool among cybercriminals, further complicating the security environment for financial institutions across Europe as they adapt to new e-banking authentication methods.
Jul 12, 2026
Investigators have linked the main breach in Jaguar Land Rover's major cyberattack to Russian hackers, according to reporting citing people close to the case. The attack halted production for months and triggered a broad investigation involving Microsoft, the FBI, the U.K. National Crime Agency, the National Cyber Security Centre, Google Mandiant, and Palo Alto Networks. Microsoft reportedly tracked the Russian group and warned JLR, while investigators said it remains unclear whether the operators were state-directed, criminal, or criminals tolerated by the Russian government. The inquiry also found that a separate Jordanian hacker using the alias `Rey` had compromised parts of JLR's network, making the incident a multi-actor intrusion. The Cyber Monitoring Centre estimated the disruption caused **£1.9 billion** in damage to the U.K. economy, or about **$2.5 billion**, with effects spreading to more than **5,000 businesses**. The fallout reportedly drove U.K. car production down to levels not seen since 1952, and the Bank of England cited the damage in its economic outlook, underscoring how the attack's impact extended far beyond Jaguar Land Rover's own operations.
Jun 30, 2026
U.S. prosecutors unsealed charges against five men allegedly linked to the **Scattered Spider** cybercrime ecosystem, accusing them of running a large-scale scheme that used SMS phishing, spoofed login pages, social engineering, stolen employee credentials, email hijacking, and SIM swapping to compromise companies and individuals. Court filings say the operation targeted technical employees across the United States between September 2021 and April 2023, enabling the theft of non-public corporate data, personal identifiers, and **millions of dollars in cryptocurrency**. Four suspects were charged in the United States with conspiracy to commit wire fraud, while a separate complaint was filed against a fifth defendant in the United Kingdom. The case adds to mounting law-enforcement scrutiny of Scattered Spider, a loose English-speaking threat actor network also tracked under multiple aliases and associated with the broader **"Com"** ecosystem. Authorities and researchers have linked the group to high-profile intrusions and collaborations with ransomware operations including **BlackCat/ALPHV**, **Qilin**, and **RansomHub**, as well as incidents affecting MGM Resorts, Clorox, Snowflake-linked victims, and later investigations into the hacks at **Marks & Spencer** and **Co-op**. The charges mark a significant escalation in efforts to disrupt a group known for blending phishing, identity takeover, and extortion-focused intrusion tactics.
Jun 29, 2026