Google has issued a warning that the hacking group responsible for recent cyberattacks on UK retailers is now targeting companies in the US. The researchers highlighted the activities of UNC3944, also known as Scattered Spider, which utilizes social engineering, SIM swapping, ransomware, and extortion in its attacks across various industries. UNC3944 has been curating targeted attacks on financial services and food services sectors, with recent reports linking the group to attacks on UK retailers such as Co-op, Harrods, and Marks & Spencer (M&S), where customer data was confirmed stolen. While the UK attacks haven’t been directly linked to Scattered Spider or DragonForce, it is suspected that the group is now focusing on the US retail sector, which is considered an attractive target due to the large volume of personally identifiable information (PII) and financial data. Retailers may be more inclined to pay ransom demands if their ability to process financial transactions is compromised. It should be noted that DragonForce recently took control of the RansomHub ransomware-as-a-service (RaaS) platform, with Scattered Spider being an affiliate in 2024. Cybersecurity experts warn that financially motivated groups are likely to continue targeting retailers, and the importance of strengthening defenses against these threats should be of emphasis. It has been confirmed that less than ten (10) US retailers have been targeted so far. Some victims have taken proactive measures by taking systems offline to contain the intrusions, although this has impacted their operations. The group has been known to exploit help desks to reset passwords and gain access to their targets, showcasing their resourcefulness and speed.