# DragonForce Ransomware: Vishing-Driven Help Desk Social Engineering Against UK Retailers (M&S, Co-op, Harrods)

> Scattered Spider affiliates operating under the DragonForce ransomware cartel compromised Marks & Spencer, Co-op, and Harrods by vishing IT help desks (including third-party contractor Tata Consultancy Services) into resetting employee credentials without proper verification, then used Mimikatz/NTDS.dit dumping, AdFind, RDP, PsExec and GPO abuse to disable EDR before deploying DragonForce ransomware against VMware ESXi hosts.

- **Published:** 2026-07-23T00:00:00Z
- **Last reviewed:** 2026-07-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1647
- **ID:** TL-2026-1647
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Scattered Spider
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Beginning as early as February 2025, Scattered Spider-affiliated actors leveraging the DragonForce ransomware-as-a-service/white-label 'cartel' model conducted a coordinated wave of intrusions against major UK retailers. The attackers used OSINT and harvested employee details to vish IT help desk staff — including at Marks & Spencer's outsourced help desk provider, Tata Consultancy Services (TCS) — into resetting multi-factor authentication and passwords for employee and privileged accounts without proper identity verification. Once inside, the actors exploited weak Active Directory configurations to escalate privileges, using Mimikatz for LSASS credential dumping and NTDS.dit extraction for offline hash cracking, AdFind for domain reconnaissance and trust discovery, and SoftPerfect Network Scanner for host/port enumeration. Lateral movement relied on living-off-the-land techniques: RDP, PsExec, SMB admin shares, and PowerShell remoting, supplemented by Cobalt Strike Beacon and a SystemBC SOCKS5 proxy implant for covert C2. Defense evasion included disabling EDR/antivirus via GPO manipulation and direct service tampering, BYOVD abuse of the RogueKiller Anti-Rootkit Driver to kill security processes at the kernel level, clearing Windows event logs (wevtutil cl System), and deleting Volume Shadow Copies via WMI/PowerShell to prevent recovery. Large volumes of data were exfiltrated via Rclone, wget, and cloud services (MEGA.nz, Amazon S3) prior to encryption, supporting a double-extortion model with data leaked on the DragonForce Tor leak site if ransom was unpaid. The DragonForce encryptor — derived from leaked LockBit 3.0 and Conti source code, using RSA+AES (ChaCha8 observed in some builds) — was deployed against Windows, Linux, and VMware ESXi hosts, encrypting entire virtual machine clusters supporting e-commerce and payment processing. At Marks & Spencer, this caused a roughly 46-day suspension of online orders, an estimated £3.8M/day in lost sales, and over £500M in market value erosion. Co-op suspended VPN access company-wide after detecting an intrusion attempt with initially limited back-office impact; Harrods publicly confirmed a cyberattack on 1 May 2025 with more limited operational disruption due to earlier containment. DragonForce operates a 'white-label' RaaS/cartel model (branded RansomBay) in which affiliates such as Scattered Spider retain roughly 80% of ransom proceeds while DragonForce takes a 20% cut and supplies leak-site and encryptor infrastructure. CISA, the FBI, and international partners (RCMP, ACSC/ASD, AFP, NCSC) issued an updated joint cybersecurity advisory on Scattered Spider on 29 July 2025 reflecting these evolved TTPs, including the shift from pure data-extortion to full DragonForce ransomware deployment.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1593 Search Open Websites/Domains
- T1587 Develop Capabilities
- T1566 Phishing
- T1078 Valid Accounts
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1543 Create or Modify System Process
- T1098 Account Manipulation
- T1134 Access Token Manipulation
- T1078 Valid Accounts
- T1685 Disable or Modify Tools
- T1211 Exploitation for Stealth
- T1070 Indicator Removal
- T1484 Domain or Tenant Policy Modification
- T1003 OS Credential Dumping
- T1621 Multi-Factor Authentication Request Generation
- T1046 Network Service Discovery
- T1482 Domain Trust Discovery
- T1083 File and Directory Discovery
- T1021 Remote Services
- T1071 Application Layer Protocol
- T1090 Proxy
- T1567 Exfiltration Over Web Service
- T1020 Automated Exfiltration
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery

## Sources

- [Hackers in Aisle 5: What DragonForce Taught Us About Zero Trust](https://www.mitiga.io/blog/hackers-in-aisle-5-what-dragonforce-taught-us-about-zero-trust)
- [DragonForce Ransomware Hits Harrods, Marks and Spencer, Co-Op & Other UK Retailers](https://cybersecuritynews.com/dragonforce-ransomware-hits-harrods-marks-and-spencer/)
- [Retail Under Fire: Inside the DragonForce Ransomware Attacks on Industry Giants](https://www.picussecurity.com/resource/blog/dragonforce-ransomware-attacks-retail-giants)
- [DragonForce Ransomware Targets Major UK Retailers, Including Harrods, Marks & Spencer, and Co-Op](https://gbhackers.com/dragonforce-ransomware-targets-major-uk-retailers/)
- [UK Retail Cyber Attacks - Detailed Timeline](https://www.cm-alliance.com/uk-retail-cyber-attacks-detailed-timeline)
- [Which UK retailers have been hit by cyber attacks in 2025?](https://www.raconteur.net/technology/which-uk-retailers-have-been-hit-by-cyber-attacks-in-2025)
- [Marks & Spencer Breach: How A Ransomware Attack Crippled a UK Retail Giant](https://www.blackfog.com/marks-and-spencer-ransomware-attack/)
- [Inside DragonForce, the Group Tied to M&S, Co-op and Harrods Hacks](https://www.infosecurity-magazine.com/news/dragonforce-goup-ms-coop-harrods/)
- [M&S ransomware hack: Service Desk & Active Directory security lessons](https://specopssoft.com/blog/marks-spencer-ransomware-active-directory/)
- [CISA and Partners Release Updated Advisory on Scattered Spider Group](https://www.cisa.gov/news-events/alerts/2025/07/29/cisa-and-partners-release-updated-advisory-scattered-spider-group)
- [Scattered Spider Ramps Up Ransomware In 2025 Cyber Alert](https://cyble.com/blog/scattered-spider-ransomware-in-2025-cyber-alert/)
- [Dark Web Profile: DragonForce Ransomware](https://socradar.io/blog/dark-web-profile-dragonforce-ransomware/)
- [dragonforce Ransomware Group - TTPs, IOCs & Intelligence](https://ismalicious.com/ransomware/group/dragonforce)
- [DragonForce Ransomware Group](https://www.group-ib.com/blog/dragonforce-ransomware/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1647