Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

Trustwave's 2023 Retail Threat Intelligence Report: Gaining Access

The Trustwave SpiderLabs team's recent in-depth look at the threats facing the retail landscape has uncovered a wide array of adversaries actively attacking this sector along with their tried-and-true methods of gaining access, moving laterally, and finally exfiltrating valuable data.


This information is thoroughly detailed in the Trustwave Threat Intelligence Briefing: The 2023 Retail Services Sector Threat Landscape.


In the report, Trustwave SpiderLabs analyzed the threat actors active in attacking the retail sector, including Royal, Bian Lian, LockBit, Clop, BlackCat, Play, 8BASE, and RasomedVC.


SpiderLabs found that these groups have a deep arsenal of well-tried hacking tools at their disposal to gain access, move laterally inside their target, and then exfiltrate data. The most prevalent tactics are email-borne malware, phishing, BEC, and vulnerability exploitation.


In the same manner that Trustwave SpiderLabs presented its earlier financialhealthcare, and hospitality reports, the Trustwave Threat Intelligence Briefing: The 2023 Retail Services Sector Threat Landscape details the most often used attack vectors.


First, Why Target Retail?


As always, the driving factor behind attacks on retailers is the massive repository of extremely valuable data held by these organizations. Threat actors covet consumer credit cards and personally identifiable information (PII) as criminals can quickly and easily monetize it.


Retailers compile this consumer data while investing significant resources to earn a coveted spot in consumers' minds as household names. The allure of brand recognition is undeniable, but it also presents a stark reality in cybersecurity: the bigger the brand, the larger the target.


This effort does pay off. The online retail, or e-commerce, market surpassed a staggering $1.09 trillion in 2022, marking a 209% increase from 2019, according to Comscore.  


In addition to financial loss due to a data breach or other type of attack, retailers face massive reputational damage, which, in the long run, may prove even more damaging than the attack itself. 


Unlike security incidents affecting businesses in less-publicized sectors, a breach involving a major retailer is almost guaranteed to become a headline-grabbing affair. While the average cost of a breach in the retail sector ($2.9 million) is lower than the industry average ($4.4 million), the extensive public awareness of these retail giants, coupled with the loyal customer base they command, can amplify the reputational consequences of any breach. 


Gaining Entry


Every attack starts with an adversary finding the target's weak spot. This area can include staff, system vulnerabilities, or even its supply chain.


SpiderLabs noted the attacker's primary methods of gaining an initial foothold were phishing emails and business email compromise attacks, using legitimate credentials, exploiting a vulnerability, and going through a third party.


While each method is described in greater detail in the report, along with additional information on lateral movement and mitigations, here is a quick overview of how most successful attacks start.


Email - Phishing and email-borne malware stand out as the most commonly exploited method for gaining an initial foothold in an organization. Instead of attempting to exploit the software or systems on the network, attackers direct their focus towards targeting the individuals operating the keyboard.


Based on the data from Trustwave's retail client base, we observed that over 70% of the malicious emails contain malicious HTML attachments, with 30% being obfuscated. These attachments include local, standalone phishing pages, redirectors, and malware. Aside from HTML, other file types included are executables, Microsoft Office documents, PDFs, and One Note files. Common malware that we found piggybacking off these attachments were Agent Tesla, Emotet, and Qakbot.


Credentials - Sometimes attackers gain access to your network simply by logging in with actual credentials. This can occur if the default credentials for a device have not been changed, weak passwords are used and thus vulnerable to brute-forcing, and sometimes credentials can be purchased from an underground forum.

Credential Access accounts for 30% of all tactics for reported incidents in our retail client base. Generic brute-force attacks make up the majority of the observations. 


Vulnerabilities - An unfortunate reality is that a great deal of software currently in use has publicly known vulnerabilities, and some are discovered by the adversary. Attackers create software or scripts to exploit the vulnerability and circumvent security controls, such as authorization, authentication, and audit controls. Once an attacker exploits the vulnerability, the attacker can bypass security controls and introduce a payload, manifesting as various types of malware.


Trustwave found the most common vulnerabilities exploited are ZeroLogon (CVE-2020-1472) and Apache Log4J (CVE-2021-44228.


Supply Chain - The report found threat actors are increasingly using supply chain attacks. These entail doing an "end around" with attackers concentrating their efforts on trusted third-party partners frequently utilized by large numbers of organizations. The result is one successful attack can lead to multiple companies being breached.


Like many industries, retailers rely heavily on third-party vendors to maintain inventory, manage deliveries, support geographic expansion, and maintain e-commerce operations, making them particularly vulnerable.  



In a world where the retail sector faces constant cyber threats, the Trustwave SpiderLabs 2023 Retail Services Sector Threat Landscape report vividly depicts the challenges ahead. 


The reputation of major retailers, coupled with loyal customer bases, only amplifies the consequences of breaches. As retailers navigate e-commerce, supply chain vulnerabilities, seasonality, omnichannel strategies, gift cards, and franchise models, they must contend with emerging threats like AI-driven phishing, malicious bots, and third-party vulnerabilities. 


Vigilance and robust cybersecurity measures are essential to protect business and consumer interests in this ever-evolving threat landscape.



Click the image above to download Trustwave Threat Intelligence Briefing: The 2023 Retail Services Sector Threat Landscape.

Latest Trustwave Blogs

Defending Healthcare Databases: Strategies to Safeguard Critical Information

The healthcare sector continues to be a primary target for threat actors, with 2023 seeing a record number of data breaches and compromised records. While successful attacks are inevitable, it’s...

Read More

Trustwave SpiderLabs: Ransomware Gangs Dominate 2024 Education Threat Landscape

The security teams manning the defenses at the higher education and primary school system levels often find themselves being tested by threat actors taking advantage of the sector's inherent cyber...

Read More

LockBit Takedown: Law Enforcement Disrupts Operations, but Ransomware Threats Likely to Persist

The news that US, UK, and other international law enforcement agencies disrupted LockBit is welcome, as stopping any threat group activity is always a positive. The unfortunate aspect is this blow...

Read More