Chasing The Most Hated Hacker In History - Joe Tidy - #954

**Chris Williamson** (0:00)
What's happening with Scattered Spider?

**Joe Tidy** (0:04)
Well, Scattered Spider is the name of this very loosely coordinated collective of hackers that are, we think, currently causing havoc around the UK and the US as well. So, I don't know if you've heard about the news of the M&S cyber attack and the co-op cyber attack. So, there's a really big, if you're not in the UK, there's a really big chain of supermarkets called M&S.
Very much loved, over 100 years old, one of the pillars of the high street. And around Easter time, there was a cyber attack which started causing problems for M&S, and it just got worse and worse and worse for them. Because initially, they said, actually, we can't take orders on the internet, which for a massive company like M&S is really bad. Then we started seeing logistics problems, empty shelves in some stores. And then around the same time, there was a very similar attack on the co-op. Again, another big supermarket chain in the UK. They also do funeral services and insurance as well. That attack wasn't as bad. But again, we're seeing disruption at stores, empty shelves, real chaos behind the scenes. And around the same time, we saw an attack on Harrods, obviously the luxury retailer in London. So everyone's wondering what on earth is going on. And things have got progressively worse. And then we hear the last couple of days, there are attacks on US retailers as well. And everyone is pointing towards this really infamous group called Scattered Spider. And they're not a normal cybercrime gang. They haven't named themselves that. They are not very organized. They come together on Discord and Telegram. A little bit like, have you heard of Anonymous?

**Chris Williamson** (1:46)
Yes.

**Joe Tidy** (1:46)
Yeah, so they're a little bit like that, but more out for cybercrime and money and infamy than sort of hacktivism. So one company called CrowdStrike started looking at this activity coming from this sort of corner of the cybercrime ecosystem. And they said, who are these people? They're doing the same kind of tricks to get into places. So they nicknamed them Scattered Spider. Spider is the name that CrowdStrike gives cybercrime groups, and scattered is the term they give for, because they're loosen it all over the place. And actually, I'm looking right now at the CrowdStrike scattered spider figurine. It's very controversial actually that they've done this, but here you go.
So they sell these on their merch website. And like I say, quite controversial actually, because it kind of glamorizes these guys. And there are some people who would say we shouldn't really glamorize cybercriminals, because the type of individuals that we think scattered spider are, very young, probably teenagers in the US and UK, they will love the attention of having their own figurine.

**Chris Williamson** (3:01)
Do you think that social media platforms like Twitter have sort of changed what hackers' motivations are from just exploration or exploitation to now fame, cloud chasing, stuff like that?

**Joe Tidy** (3:15)
Absolutely, yeah. When I wrote this book, my publisher on the first draft, my publisher said, now that's all great, but can you answer some questions as to how this has happened and why this has happened? They really challenged me and I work for the BBC, so normally, we've got to be very careful about giving opinions and putting our necks on the line in terms of theories about things. But it was quite good because I landed on this. There are two factors which I think have turned teenage hackers from largely benevolent groups of people that are out to make a name for themselves, but they're also out to make the Internet a safer place to where we are now, where we've got cybercrime gangs, teenage gangs that are causing mayhem and trying to make money. I think Twitter is a very, that you could see at that point when Twitter becomes mainstream, this shift is starting to take place. Because of course, before Twitter, social networks were about being social with your network. Whereas Twitter invented the idea of followers and retweets and likes and clout online. That's when we started seeing in 2011 when Twitter was really on the ascendancy. We saw LOLSEC, the first of this conveyor belt of teenage cybercrime gangs.

**Chris Williamson** (4:29)
Yeah, there's no one flexing their recent ransomware exploitation on that personal Facebook account. That wouldn't work, but on Twitter, that would be great.

**Joe Tidy** (4:40)
Yeah, absolutely. We know from interviews with arrested hackers and convicted hackers, they loved it. They loved the attention back then. I think where we are now is slightly different because I think what we're seeing is they have come off Twitter or X, whatever they're calling it, and now it's more in the insular communities, but they're still after that online clout and that infamy. It's just they're in their own channels in Telegram and Discord.