Trustwave SpiderLabs Exposes Unique Cybersecurity Threats in the Public Sector. Learn More

Trustwave SpiderLabs Exposes Unique Cybersecurity Threats in the Public Sector. Learn More

Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Offensive Security
Solutions to maximize your security ROI
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats
News Releases

Trustwave SpiderLabs Exposes Critical Cybersecurity Threats Targeting Retailers

Chicago – November 15, 2023 Trustwave, a leading cybersecurity and managed security services provider, today released comprehensive research shedding light on the distinctive cybersecurity risks facing retailers. The report, “2023 Retail Threat Landscape: Trustwave Threat Intelligence Briefing and Mitigation Strategies,” explores the specific threats and risks the retail industry faces, along with practical insights and mitigations to strengthen defenses.

In its new research, Trustwave SpiderLabs has documented the attack flow utilized by threat groups, exposing their tactics, techniques, and procedures. From email-borne malicious attachments to automated bots to remote access trojans, these persistent threats pose significant risks to the retail sector.

Retailers today are facing a barrage of mounting cybersecurity challenges. Unlike security incidents affecting businesses in less-publicized sectors, a breach involving a major retailer is almost guaranteed to become a headline- grabbing affair. Adding to the complexity, the e-commerce market surpassed a staggering $1.09 trillion in 2022, marking a 209% increase from the levels of 2019, according to Comscore.

"The significant shift towards digital commerce that unfolded during the global pandemic marked a pivotal moment for retailers,” said Trustwave CISO Kory Daniels. “An industry historically focused on compliance and point-of-sale security had to rapidly adapt to surging consumer demands, virtual workforces, and evolving threat actors. Our latest threat briefing is a valuable resource for retail leaders and cyber defenders, providing a comprehensive view of the threats observed by our Trustwave SpiderLabs team, along with specific mitigation strategies to help organizations protect themselves, their consumers, and their assets.”

The Trustwave SpiderLabs report analyzes threat groups and their methods throughout the attack cycle, from initial foothold through to exfiltration. A few key findings from the report include:

  • The threat group LockBit accounted for 34% of ransomware incidents targeting the retail sector.
  • A majority of the targeted retailers who reported a breach were from the United States (57%) with the United Kingdom (8%), and Canada (7%) coming in a far second and third, respectively.
  • 30% of all reported incidents in retail can be attributed to Credential Access, of which 90% are through brute force.
  • As lures for phishing emails, 59% use “Payroll Diversion,” followed by 19% “Request for Contract.”

Trustwave SpiderLabs’ research serves as a resource for retailers to understand and combat the multitude of attack groups, malware variants, and techniques deployed against them. The report explores:


Cybersecurity Challenges Unique to the Retail Industry

  • Rise of E-commerce: The shift to e-commerce has made retailers more vulnerable to cyberattacks in a number of ways, including additional data storage and increased reliance on third-party vendors.
  • Seasonality: Retail businesses experience significant fluctuations in traffic and sales throughout the year, making it difficult to maintain security and compliance standards across the board.
  • Omnichannel: Retailers today typically operate across multiple channels, including physical stores, e-commerce websites, and mobile apps, which provides convenience to consumers but complicates security.
  • Prevalence of Gift Cards: Threat actors utilize gift cards to maintain anonymity in their transactions and, more alarmingly, to launder funds sourced from compromised credit cards and other payment platforms.
  • Franchise Model: A security breach at one franchise could damage the reputation of the entire brand. Additionally, franchisees may not have the same level of security resources as the parent company, making them more vulnerable to cyberattacks.

Prevalent Threat Actors and Threat Tactics Operating Across Retail


Threat Actors:

  • 8BASE
  • Bian Lian
  • BlackCat/ALPHV
  • Clop
  • LockBit
  • Play
  • RansomedVC
  • Royal

Threat Tactics:

  • Access for Sale
  • Bot Attacks
  • Business Email Compromise (BEC)
  • Consumer-Based Attacks
  • Credential Access
  • Email-Borne Malware
  • Gift Card Fraud and Scams
  • Malware
  • Phishing
  • Vulnerability Exploitation


To access the full Trustwave SpiderLabs threat report, "2023 Retail Threat Landscape: Trustwave Threat Intelligence Briefing and Mitigation Strategies," please click here.


About Trustwave


Trustwave is a globally recognized cybersecurity leader that reduces cyber risk and fortifies organizations against disruptive and damaging cyber threats.

Trustwave’s comprehensive offensive and defensive cybersecurity portfolio detects what others cannot, responds with greater speed and effectiveness, optimizes its client’s cyber investment, and improves security resilience. Trusted by thousands of organizations worldwide, Trustwave leverages its world-class team of security consultants, threat hunters, and researchers, and its market-leading security operations platform to decrease the likelihood of attacks and minimize potential impact.

Trustwave is an analyst-recognized leader in managed detection and response (MDR), managed security services (MSS), cyber advisory, penetration testing, database security, and email security. The elite Trustwave SpiderLabs team provides industry-defining threat research, intelligence, and threat hunting, all of which are infused into Trustwave services and products to fortify cyber resilience in the age of inevitable cyber-attacks.

For more information about Trustwave, please visit:



Devon Swanson

Latest News Releases

Trustwave SpiderLabs Exposes Unique Cybersecurity Threats in Public Sector

Chicago – May 14 – Trustwave, a leading cybersecurity and managed security services provider, today released a comprehensive report titled "2024 Public Sector Threat Landscape: Trustwave Threat...

Read More

Trustwave Named as a Leader in the 2024 IDC MarketScape for Worldwide Emerging MDR Services

Chicago – May 7, 2024 – Trustwave, a leading cybersecurity and managed security services provider, today announced its placement in the Leaders Category in the IDC MarketScape: Worldwide Emerging...

Read More

Trustwave Welcomes Keith Ibarguen as Senior Vice President of Engineering

Chicago – May 2, 2024 – Trustwave, a leading cybersecurity and managed security services provider, today announced the appointment of Keith Ibarguen as Senior Vice President of Engineering. In this...

Read More