Trustwave SpiderLabs Exposes Critical Cybersecurity Threats Targeting Retailers

Chicago – November 15, 2023 – Trustwave, a leading cybersecurity and managed security services provider, today released comprehensive research shedding light on the distinctive cybersecurity risks facing retailers. The report, “2023 Retail Threat Landscape: Trustwave Threat Intelligence Briefing and Mitigation Strategies,” explores the specific threats and risks the retail industry faces, along with practical insights and mitigations to strengthen defenses.

In its new research, Trustwave SpiderLabs has documented the attack flow utilized by threat groups, exposing their tactics, techniques, and procedures. From email-borne malicious attachments to automated bots to remote access trojans, these persistent threats pose significant risks to the retail sector.

Retailers today are facing a barrage of mounting cybersecurity challenges. Unlike security incidents affecting businesses in less-publicized sectors, a breach involving a major retailer is almost guaranteed to become a headline- grabbing affair. Adding to the complexity, the e-commerce market surpassed a staggering $1.09 trillion in 2022, marking a 209% increase from the levels of 2019, according to Comscore.

"The significant shift towards digital commerce that unfolded during the global pandemic marked a pivotal moment for retailers,” said Trustwave CISO Kory Daniels. “An industry historically focused on compliance and point-of-sale security had to rapidly adapt to surging consumer demands, virtual workforces, and evolving threat actors. Our latest threat briefing is a valuable resource for retail leaders and cyber defenders, providing a comprehensive view of the threats observed by our Trustwave SpiderLabs team, along with specific mitigation strategies to help organizations protect themselves, their consumers, and their assets.”

The Trustwave SpiderLabs report analyzes threat groups and their methods throughout the attack cycle, from initial foothold through to exfiltration. A few key findings from the report include:

• The threat group LockBit accounted for 34% of ransomware incidents targeting the retail sector.
• A majority of the targeted retailers who reported a breach were from the United States (57%) with the United Kingdom (8%), and Canada (7%) coming in a far second and third, respectively.
• 30% of all reported incidents in retail can be attributed to Credential Access, of which 90% are through brute force.
• As lures for phishing emails, 59% use “Payroll Diversion,” followed by 19% “Request for Contract.”

Trustwave SpiderLabs’ research serves as a resource for retailers to understand and combat the multitude of attack groups, malware variants, and techniques deployed against them. The report explores:

Cybersecurity Challenges Unique to the Retail Industry

• Rise of E-commerce: The shift to e-commerce has made retailers more vulnerable to cyberattacks in a number of ways, including additional data storage and increased reliance on third-party vendors.
• Seasonality: Retail businesses experience significant fluctuations in traffic and sales throughout the year, making it difficult to maintain security and compliance standards across the board.
• Omnichannel: Retailers today typically operate across multiple channels, including physical stores, e-commerce websites, and mobile apps, which provides convenience to consumers but complicates security.
• Prevalence of Gift Cards: Threat actors utilize gift cards to maintain anonymity in their transactions and, more alarmingly, to launder funds sourced from compromised credit cards and other payment platforms.
• Franchise Model: A security breach at one franchise could damage the reputation of the entire brand. Additionally, franchisees may not have the same level of security resources as the parent company, making them more vulnerable to cyberattacks.
  
  

Prevalent Threat Actors and Threat Tactics Operating Across Retail

Threat Actors:

• 8BASE
• Bian Lian
• BlackCat/ALPHV
• Clop
• LockBit
• Play
• RansomedVC
• Royal

Threat Tactics:

• Access for Sale
• Bot Attacks
• Business Email Compromise (BEC)
• Consumer-Based Attacks
• Credential Access
• Email-Borne Malware
• Gift Card Fraud and Scams
• Malware
• Phishing
• Vulnerability Exploitation

To access the full Trustwave SpiderLabs threat report, "2023 Retail Threat Landscape: Trustwave Threat Intelligence Briefing and Mitigation Strategies," please click here.

About Trustwave

Trustwave is a globally recognized cybersecurity leader that reduces cyber risk and fortifies organizations against disruptive and damaging cyber threats.

Trustwave’s comprehensive offensive and defensive cybersecurity portfolio detects what others cannot, responds with greater speed and effectiveness, optimizes its client’s cyber investment, and improves security resilience. Trusted by thousands of organizations worldwide, Trustwave leverages its world-class team of security consultants, threat hunters, and researchers, and its market-leading security operations platform to decrease the likelihood of attacks and minimize potential impact.

Trustwave is an analyst-recognized leader in managed detection and response (MDR), managed security services (MSS), cyber advisory, penetration testing, database security, and email security. The elite Trustwave SpiderLabs team provides industry-defining threat research, intelligence, and threat hunting, all of which are infused into Trustwave services and products to fortify cyber resilience in the age of inevitable cyber-attacks.

For more information about Trustwave, please visit: https://www.trustwave.com/en-us/.

Contact

Devon Swanson

devon.swanson@trustwave.com