New Wave of Cyber Threats: Elite Hacking Group Shifts Focus to U.S. Targets
An advanced cybercriminal operation, previously active against top UK retail entities, is now directing its attacks toward major businesses in the United States, according to newly released intelligence from Google Cloud.
The group, referred to internally as UNC3944—also known in other threat reporting circles as Scattered Spider—is notorious for its aggressive tactics and expert-level social engineering. Their approach is especially effective against enterprises with extensive support operations and outsourced IT services, which provide fertile ground for manipulation and access.
Originally, UNC3944 made headlines for targeting telecom firms to execute SIM-swapping scams. However, in 2023, they shifted gears—turning to high-stakes ransomware deployments and data extortion schemes. In one notable incident, they reportedly unleashed the DragonForce ransomware on a UK-based retail network. BBC News later confirmed that actors linked to DragonForce claimed responsibility for multiple breach attempts across retail brands in the UK.
Mandiant, part of Google Cloud, has flagged a concerning trend: the retail sector is becoming a prime target for this group. As of 2025, retail organizations account for over 11% of all victims listed on data leak sites—up from 8.5% in 2024. Analysts attribute this rise to the sector’s heavy reliance on sensitive customer data and the potentially devastating impact of service disruptions caused by ransomware.
Geographically, UNC3944’s operations primarily span English-speaking countries—including the U.S., UK, Canada, and Australia—but recent activity suggests an expansion into regions such as Singapore and India. Their targets are typically large-scale enterprises with complex support infrastructures, which make impersonation and social engineering attacks both feasible and effective.
Engineering Trust: How UNC3944 Breaches Organizations
At the core of UNC3944’s playbook lies a highly refined social engineering strategy. Their campaigns often begin with SMS phishing messages disguised as IT alerts, urging recipients to install “compliance software.” They follow up with voice calls to IT support desks, where they impersonate employees requesting password resets or changes to multi-factor authentication settings.
Organizations can detect these impersonation attempts by employing advanced monitoring tools. For instance, Google SecOps offers the following detection logic for spotting suspicious impersonation attempts within Microsoft Teams:
Plaintext
metadata.vendor_name = “Microsoft”
metadata.product_name = “Office 365”
metadata.product_event_type = “ChatCreated”
security_result.detection_fields[“ParticipantInfo”] = “true”
(
principal.user.userid = /help/ OR
principal.user.email_addresses = /help/ OR
about.user.user_display_name = /help/
)
What’s Next?
Although UNC3944’s operations were disrupted in 2024 due to enforcement actions targeting suspected members, experts warn that the group’s alliances within broader cybercriminal networks may enable a swift resurgence. Unlike smaller, siloed threat actors, UNC3944 benefits from shared tools, tactics, and infrastructure—making them a persistent threat even after setbacks.
For CISOs, security leaders, and incident response teams, vigilance is key. Monitoring social engineering patterns, enhancing identity verification protocols, and employing detection logic tailored to impersonation attacks are crucial steps in staying ahead of groups like UNC3944.
Inside the Playbook: How UNC3944 Breaks In
According to research from Google Cloud, the cyber group UNC3944—notorious for its bold social engineering campaigns—has developed a high-pressure attack model designed to exploit human fatigue and trust.
A key tactic in their arsenal is authentication spamming, commonly known as MFA fatigue. This method bombards employees with repeated login approval requests until someone, out of confusion or annoyance, grants access. Once inside the perimeter, they shift gears.
They’ve also begun exploiting business communication tools like Microsoft Teams to impersonate internal IT staff. These attackers craft detailed impersonations, blending in with existing workflows and convincing users to either disclose passwords or confirm login prompts—believing they’re helping the help desk.
In more extreme scenarios, victims have reported the use of coercion, including personal threats and aggressive messages—tactics that shift the psychological pressure into overdrive.
Defense in Depth: Recommendations for Resilience
To combat these manipulative strategies, security professionals stress the importance of verified identity workflows. Before approving sensitive account actions, organizations should enforce:
- Live ID verification via video
- Government-issued ID checks
- Challenge-response authentication questions
Moreover, organizations should phase out vulnerable methods like SMS and email-based authentication. Instead, they should adopt phishing-resistant MFA technologies, such as FIDO2-compliant security keys, which eliminate reliance on guessable or interceptable authentication methods.
UNC3944’s techniques are a reminder that attackers aren’t just hacking systems—they’re hacking people. That means prevention must start at the intersection of technology, training, and trust.
