Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

Trustwave Threat Intelligence Briefing: The 2023 Retail Services Sector Threat Landscape

The holiday shopping season is teed up for its annual explosion of spending. Retailers know this, consumers know this, cybercriminals know this, and are unfortunately ready to take advantage of any weak link that can be found to steal vital consumer and business data.


However, unlike gift buyers heading to stores or shopping online on Black Friday and Cyber Monday, these adversaries are not seasonal actors. The danger facing the retail sector is year-long and growing, as revealed in the just-released Trustwave Threat Intelligence Briefing: The 2023 Retail Services Sector Threat Landscape.


Trustwave SpiderLabs analyzed the threat actors active in attacking the retail sector, including Royal, Bian Lian, LockBit, Clop, BlackCat, Play, 8BASE, and RasomedVC.


These groups have a deep arsenal of well-tried hacking tools at their disposal to gain access, move laterally inside their target, and then exfiltrate data. The most prevalent tactics are email-borne malware, phishing, BEC, and vulnerability exploitation, among others.


Why Target Retail?


As always, the driving factor behind attacks on retailers is the massive repository of extremely valuable data held by these organizations. Threat actors highly covet consumer credit card and personally identifiable information (PII) as criminals can quickly and easily monetize it.


Retailers compile this consumer data while investing significant resources to earn a coveted spot in consumers' minds as household names. The allure of brand recognition is undeniable, but it also presents a stark reality in the realm of cybersecurity: the bigger the brand, the larger the target.


This effort does pay off. The online retail, or e-commerce, market surpassed a staggering $1.09 trillion in 2022, marking a 209% increase from 2019, according to Comscore.  


In addition to financial loss due to a data breach or other type of attack, retailers face massive reputational damage, which, in the long run, may prove even more damaging than the attack itself. 


Unlike security incidents affecting businesses in less-publicized sectors, a breach involving a major retailer is almost guaranteed to become a headline-grabbing affair. While the average cost of a breach in the retail sector ($2.9 million) is lower than the industry average ($4.4 million), the extensive public awareness of these retail giants, coupled with the loyal customer base they command, can amplify the reputational consequences of any breach. 


Retail's Weak Points


The Trustwave SpiderLabs' report spotlights five vital business areas that allow retailers to remain profitable, but also offer avenues of attack to threat actors. Here is an abridged version of the findings:


  • E-commerce: E-commerce retailers store a large amount of sensitive customer data, such as credit card numbers and shipping addresses.
  • Supply Chain Vulnerabilities: The complex web of suppliers, logistics partners, and distributors can introduce multiple points of vulnerability.
  • Seasonality: Seasonality can make it difficult to maintain security and compliance standards.
  • Omnichannel: An omnichannel approach provides convenience for customers, but it also complicates security. 
  • Prevalence of Gift Cards: Threat actors utilize gift cards to maintain anonymity in their transactions and, more alarmingly, to launder funds sourced from compromised credit cards and other payment platforms. 
  • Franchise Model: A security breach at one franchise could damage the reputation of the entire brand. 


Emerging and Prominent Threats


In the same manner that Trustwave SpiderLabs presented its earlier financial, healthcare and hospitality reports, the Trustwave Threat Intelligence Briefing: The 2023 Retail Services Sector Threat Landscape details the most often used attack vectors.


Artificial Intelligence and Generative AI


While AI isn’t new, the advances made in Generative AI and Large Language Models (LLMs) are setting new benchmarks for what’s possible for retail organizations and for adversaries and defenders. Organizations need to be aware of privacy issues when using AI for their purposes, while threat actors have found a myriad of uses for this technology.

AI and LLM are a boon for adversaries who attempt to utilize phishing emails to gain access to their targets. Phishing is still the prime method used for gaining an initial foothold, and AI and LLMs that can generate authentic appearing and error free emails make them hard for the recipient to spot.


Automated Bot Attacks in Retail


The SpiderLabs team observed a significant increase in malicious bot traffic during the holiday shopping season which poses a threat to online retailers. These bots engage in various automated threats, including credential stuffing, account takeover, gift card cracking, web scraping, API scraping, fake account creation, and inventory scalping. The two types most often used are nicknamed Grinchbots and Freebie Bots.

Bot attacks can potentially slow down or even disrupt online operations of retailers by simulating consumer actions, leading to an overwhelming increase in website traffic. These bots extract pricing information, exploit promotions, and carry out fraudulent transactions, impacting online retail significantly. This increased bot activity may raise operational costs, affecting website resources, marketing, technical support, and even cause financial losses through fraud.


Third-party Risk and Exposure


As with many sectors, the retail industry is increasingly reliant on third-party vendors for a variety of services, such as point-of-sale systems, payment processing, supply chain management, and customer relationship management.

Cybercriminals commonly prefer to attack these third parties as a flanking maneuver—if the attack succeeds, they gain access to the targeted company’s data. Perhaps more importantly, these aforementioned third parties pose a grave risk to retail organizations because of the large dependency of these organizations on third-party software and vendors for day-to-day operations. Recent supply chain headlines, like SolarWinds and 3CX, underscore the exposure that third-party vendors can create for retail organizations.

In a world where the retail sector faces constant cyber threats, the Trustwave SpiderLabs 2023 Retail Services Sector Threat Landscape report paints a vivid picture of the challenges ahead.

The reputation of major retailers, coupled with loyal customer bases, only amplifies the consequences of breaches. As retailers navigate e-commerce, supply chain vulnerabilities, seasonality, omnichannel strategies, gift cards, and franchise models, they must also contend with emerging threats like AI-driven phishing, malicious bots, and third-party vulnerabilities.

Vigilance and robust cybersecurity measures are essential to protect both business and consumer interests in this ever-evolving threat landscape.


Latest Trustwave Blogs

Defending Healthcare Databases: Strategies to Safeguard Critical Information

The healthcare sector continues to be a primary target for threat actors, with 2023 seeing a record number of data breaches and compromised records. While successful attacks are inevitable, it’s...

Read More

Trustwave SpiderLabs: Ransomware Gangs Dominate 2024 Education Threat Landscape

The security teams manning the defenses at the higher education and primary school system levels often find themselves being tested by threat actors taking advantage of the sector's inherent cyber...

Read More

LockBit Takedown: Law Enforcement Disrupts Operations, but Ransomware Threats Likely to Persist

The news that US, UK, and other international law enforcement agencies disrupted LockBit is welcome, as stopping any threat group activity is always a positive. The unfortunate aspect is this blow...

Read More