Scattered Spider Suspected in Major M&S Cyberattack

**Executive summary:** The retail giant Marks & Spencer suffered a ransomware incident attributed to the Scattered Spider group that reportedly involved theft of the NTDS.dit (enabling credential compromise), lateral movement, and deployment of the DragonForce encryptor against VMware ESXi virtual machines on April 24; the attack disrupted contactless payments, Click & Collect, online orders and store supply, causing substantial financial and operational losses.