A rarity: Hackers use local accents to hoodwink employees

A rarity

- Dan Milmo

If there is one noticeable difference between some members of the Scattered Spider hacking community and their ransomware peers, it will be the accent. Scattered Spider has been linked to a cyber-attack on Marks & Spencer. But unlike other ransomware assailants, its constituents appear to be native English speakers and not from Russia or former Soviet states.

This helps with one of the techniques in their armoury that a Russian hacker might struggle to replicate: ringing up company IT desks and gaining entry to systems by pretending to be employees, or pretending to be from company IT desks and calling employees.

"Native English authenticity can sometimes lead to an automatic sense of trust. There is a level of perceived familiarity that might cause personnel or even IT teams to lower their guard slightly," said Nathaniel Jones, the vice-president of security and AI strategy at the Cambridge-based cybersecurity company Darktrace.

In November, the US Department of Justice gave an insight into Scattered Spider's alleged personnel by charging five individuals over the targeting of unnamed American companies with "phishing" text messages.