Marks & Spencer and Co-op had reported that their IT help desks were convinced by a caller to reset an employee password. DragonForce has claimed credit for the attacks, all of which impacted major UK retailers, including Harrods.
What sets Octo Tempest apart from other cybercriminals is the highly advanced social engineering capability, something that ransomware gangs typically struggle with. The group’s current modus operandi is to target support and help desk employees.
The Verizon DBIR for 2023 is out, and it shows an increase in social engineering as an entry point for threat actors. Attackers would prefer to do as little hacking as possible, and the availability of stolen credentials is making that a realistic business plan.
Another security breach has impacted over a hundred Mailchimp customers. Social engineering was used to gain access to the company’s customer support tools similar to prior attacks.
A social engineering attack apparently ensnared a member of the BWI Airport Marriott staff, with the ensuing data breach leaking 20GB of data including credit card information.