# NCSC warns retailers of recent ransomware incidents

Published: 2025-05-04 · Severity: routine · Sectors: retail
Canonical: https://vorant.io/reports/4bc68941-11ae-5ff6-a387-936e0ee46c97/ncsc-warns-retailers-of-recent-ransomware-incidents

> UK retailers targeted by ransomware attacks; NCSC suspects Scattered Spider involvement using social engineering against helpdesks.

The UK National Cyber Security Centre (NCSC) is responding to recent ransomware and extortion incidents targeting the retail sector. While investigation is ongoing, the NCSC has not yet determined whether the attacks are linked or represent a coordinated campaign by a single actor. There is speculation in media reports that the threat actor known as Scattered Spider may be responsible, with particular concern around social engineering attacks targeting IT helpdesks to obtain password and multi-factor authentication (MFA) resets.

The NCSC emphasizes that effective defense requires both prevention and detection capabilities. Key tactics attributed to Scattered Spider include exploiting legitimate employee access through helpdesk social engineering. The NCSC recommends comprehensive deployment of multi-factor authentication, enhanced monitoring for unauthorized account misuse (particularly targeting privileged accounts such as Domain Admin, Enterprise Admin, and Cloud Admin), review of helpdesk authentication procedures before password resets, detection of logins from atypical sources, and rapid integration of threat intelligence into security operations. The NCSC notes that ransomware-as-a-service models are increasing the volume and opportunistic nature of attacks across all organization sizes.

## Mentioned in this report

- Threat actors: Scattered Spider
- Malware: Ransomware variants

## Detection guidance (public sample)

### Azure AD MFA Request Denied or Unanswered

ATT&CK: T1621

Azure AD sign-in failed during the strong authentication step (MFA denied or not answered), a pattern seen in MFA fatigue against accounts with valid passwords. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Azure AD MFA Request Denied or Unanswered
description: Detects Azure AD sign-in events where authentication failed during the
  strong authentication (MFA) request, result code 500121. A single event is weak
  signal. Alert on repeated hits for the same user in a short window (for example
  5 or more in 10 minutes), which indicates MFA fatigue or push-bombing after password
  compromise.
tags:
- attack.credential-access
- attack.t1621
- attack.t1078.004
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ResultType: 500121
  condition: selection
falsepositives:
- Legitimate users who mistype or ignore their own MFA prompts
- Users with a broken or replaced authenticator app
level: medium
id: 840494c6-7c11-57ff-9100-78c7ff907ac6
status: experimental
author: Vorant
references:
- https://www.ncsc.gov.uk/blog-post/incidents-impacting-retailers
```

### Azure AD Administrative Password Reset or MFA Method Removal

ATT&CK: T1078.004

An admin-initiated password reset or deletion of a user's MFA method, the outcome an attacker seeks when social engineering an IT helpdesk. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Azure AD Administrative Password Reset or MFA Method Removal
description: Detects administrative password resets and admin deletion of a user's
  security info (MFA methods) in Azure AD audit logs. This is the end result of helpdesk
  social engineering. Correlate with the helpdesk ticket and prioritise privileged
  targets and resets followed by sign-ins from new locations.
tags:
- attack.persistence
- attack.initial-access
- attack.t1078.004
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message:
    - Reset password (by admin)
    - Admin deleted security info
    - Reset user password
  condition: selection
falsepositives:
- Routine helpdesk password resets for locked-out users
- Offboarding or device-replacement procedures that clear MFA methods
level: medium
id: 2ecd6c0e-9763-5023-841a-912f677d391b
status: experimental
author: Vorant
references:
- https://www.ncsc.gov.uk/blog-post/incidents-impacting-retailers
```

### Azure AD New Security Info Registered for User

ATT&CK: T1078.004

A new MFA or authentication method registered for an account, which attackers do after a helpdesk reset to keep access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Azure AD New Security Info Registered for User
description: Detects registration of new security info (MFA or authentication methods)
  in Azure AD, whether by the user or by an admin. After a social-engineered reset,
  attackers register their own MFA method to persist. Review events that follow a
  password reset or come from an unusual IP or location, and prioritise privileged
  accounts.
tags:
- attack.persistence
- attack.t1078.004
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message:
    - User registered security info
    - Admin registered security info
  condition: selection
falsepositives:
- New employee onboarding and first-time MFA enrolment
- Users enrolling a replacement phone
level: low
id: 85cf275f-66ab-515d-bfbf-1a70a3726ce9
status: experimental
author: Vorant
references:
- https://www.ncsc.gov.uk/blog-post/incidents-impacting-retailers
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ncsc.gov.uk/blog-post/incidents-impacting-retailers

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4bc68941-11ae-5ff6-a387-936e0ee46c97/ncsc-warns-retailers-of-recent-ransomware-incidents.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup