Unwrapping Retail Peak Season Cyber Threats

What it is

Unit 42's peak-season threat briefing for retailers, written on 30 October 2026 and based on its work against Fortune 100 retailers. Beyond the threat categories in the summary, it names the actors, gives incident mechanics and links the defences to the holiday code-freeze window.

How it works

• Ransomware. As of 30 September 2026, 565 retail victims have been claimed, with median victim revenue around $22 million. The three most active operators against retail are TGR-CRI-1173 (The Gentlemen), Spikey Scorpius (Qilin) and Howling Scorpius (Akira). In December 2023, Ambitious Scorpius (ALPHV) stole millions of customer records from a retailer and delayed fulfilment, cancelled e-commerce orders and slowed inventory replenishment.
• Extortion without encryption. Bling Libra (ShinyHunters) and Hazy Scorpius (CL0P) skip ransomware to shorten the attack lifecycle. In December 2021, Bling Libra took hundreds of gigabytes, including hashed passwords and employee files with salaries and tax IDs.
• Skimming via CosmicSting. In October 2024, unspecified actors used CVE-2024-34102 for remote code execution on unpatched servers. They installed persistent backdoors and injected skimming scripts into checkout flows. The page says this affected roughly 5% of online stores on prominent e-commerce platforms, ahead of Black Friday and Cyber Monday.
• DDoS. In December 2025, Noname057(16) used the DDoSia botnet for TCP SYN and HTTP GET floods against a victim's web portals and API endpoints. Package tracking, merchant payment services and parcel processing were disrupted.
• Gift card fraud. Unit 42 tracks the Jingle Thief campaign (reported October 2025) as CL-CRI-1032 (Storm-0539). Phishing and smishing against retail employees yields credentials. The actors then abuse cloud infrastructure to issue gift cards at scale.
• Account takeover. In December 2022, credential stuffing against a retailer's mobile app and web login APIs compromised thousands of loyalty accounts. Gift card balances, mobile payment funds and reward points were drained, and access was resold on dark web forums.
• AI-assisted intrusion. Unit 42 describes an incident where a human attacker used frontier AI models to run parts of an intrusion in under 10 hours, work it says would take multiple operators at least two weeks. The page also cites Anthropic's reporting on Bling Libra using Claude for reconnaissance and exfiltration. It cites Gambit Security on more than 600,000 payment card records stolen via JavaScript skimmers, and NorForge on a threat actor using the Cairn autonomous penetration testing agent against e-commerce sites, POS infrastructure and web applications.

Preconditions / Affected

Timing matters. The page notes that SolarWinds (December 2020) and the Log4j zero-day (December 2021) landed during code freezes, which limited retailers' ability to change critical systems. CosmicSting exposure depends on unpatched servers.

What to do

• Remediate unpatched server flaws and correct configuration drift before the holiday code freeze, using CSPM and ASPM for continuous vulnerability identification.
• Put WAAP in front of checkout and APIs to intercept remote code execution attempts and client-side script tampering.
• Use WAAP bot mitigation on login APIs to separate credential stuffing from real customers, and block traffic to known C2 infrastructure.
• Apply dynamic rate limiting, automated filtering and distributed edge capacity against DDoS.
• Add DLP and attack surface management against exfiltration, with least-privilege zero trust access.
• Use behavioural endpoint protection, segmentation and inline sandboxing for ransomware containment.
• Aim to cut MTTD and MTTR from hours to minutes by unifying endpoint, network, cloud and identity telemetry with automated response.

Caveats

The page gives no detection queries, indicators or commands. Several incidents name no victim or actor. The page closes with recommendations for Palo Alto Networks products (Cortex XSIAM, XDR, Cortex Cloud) and Unit 42 services. Its extortion statistic (78% without encryption, from the 2026 Unit 42 Global Incident Response Report) is stated ambiguously.