Trustwave SpiderLabs exposes critical cybersecurity threats targeting retailers  

November 15 – Trustwave, a leading cybersecurity and managed security services provider, has released comprehensive research shedding light on the distinctive cybersecurity risks facing retailers. The report, “2023 Retail Threat Landscape: Trustwave Threat Intelligence Briefing and Mitigation Strategies,” explores the specific threats and risks the retail industry faces, along with practical insights and mitigations to strengthen defences.  

In its new research, Trustwave SpiderLabs has documented the attack flow utilised by threat groups, exposing their tactics, techniques, and procedures. From email-borne malicious attachments to automated bots to remote access trojans, these persistent threats pose significant risks to the retail sector.  

Retailers today are facing a barrage of mounting cybersecurity challenges. Unlike security incidents affecting businesses in less-publicised sectors, a breach involving a major retailer is almost guaranteed to become a headline- grabbing affair. Adding to the complexity, the e-commerce market surpassed a staggering US$1.09 trillion in 2022, marking a 209 per cent increase from the levels of 2019, according to Comscore. 

Kory Daniels, chief information security officer, Trustwave, said, “The significant shift towards digital commerce that unfolded during the global pandemic marked a pivotal moment for retailers. 

 “An industry historically focused on compliance and point-of-sale security had to rapidly adapt to surging consumer demands, virtual workforces, and evolving threat actors. Our latest threat briefing is a valuable resource for retail leaders and cyber defenders, providing a comprehensive view of the threats observed by our Trustwave SpiderLabs team, along with specific mitigation strategies to help organisations protect themselves, their consumers, and their assets.” 

The Trustwave SpiderLabs report analyses threat groups and their methods throughout the attack cycle, from initial foothold through to exfiltration. A few key findings from the report include: 

• The threat group LockBit accounted for 34 per cent of ransomware incidents targeting the retail sector. 
• A majority of the targeted retailers who reported a breach were from the United States (57 per cent) with the United Kingdom (8 per cent), and Canada (7 per cent) coming in a far second and third, respectively. 
• 30 per cent of all reported incidents in retail can be attributed to Credential Access, of which 90 per centare through brute force. 
• As lures for phishing emails, 59 per cent use “Payroll Diversion,” followed by 19 per cent “Request for Contract.” 

Trustwave SpiderLabs’ research serves as a resource for retailers to understand and combat the multitude of attack groups, malware variants, and techniques deployed against them. The report explores: 

Cybersecurity challenges unique to the retail industry 

• Rise of e-commerce: The shift to e-commerce has made retailers more vulnerable to cyberattacks in a number of ways, including additional data storage and increased reliance on third-party vendors.  
• Seasonality: Retail businesses experience significant fluctuations in traffic and sales throughout the year, making it difficult to maintain security and compliance standards across the board.  
• Omnichannel: Retailers today typically operate across multiple channels, including physical stores, e-commerce websites, and mobile apps, which provides convenience to consumers but complicates security.  
• Prevalence of gift cards: Threat actors utilise gift cards to maintain anonymity in their transactions and, more alarmingly, to launder funds sourced from compromised credit cards and other payment platforms.  
• Franchise model: A security breach at one franchise could damage the reputation of the entire brand. Additionally, franchisees may not have the same level of security resources as the parent company, making them more vulnerable to cyberattacks.  

Prevalent threat actors and threat tactics operating across retail 

Threat actors: 

• 8BASE 
• Bian Lian 
• BlackCat/ALPHV  
• Clop  
• LockBit  
• Play 
• RansomedVC  
• Royal 

Threat tactics: 

• Access for Sale 
• Bot Attacks 
• Business Email Compromise (BEC)  
• Consumer-Based Attacks 
• Credential Access  
• Email-Borne Malware 
• Gift Card Fraud and Scams  
• Malware 
• Phishing 
• Vulnerability Exploitation  

To access the full Trustwave SpiderLabs threat report, “2023 Retail Threat Landscape: Trustwave Threat Intelligence Briefing and Mitigation Strategies,” please click here. 

About Trustwave 

Trustwave is a globally recognised cybersecurity leader that reduces cyber risk and fortifies organisations against disruptive and damaging cyber threats. 

Trustwave’s comprehensive offensive and defensive cybersecurity portfolio detects what others cannot, responds with greater speed and effectiveness, optimises its client’s cyber investment, and improves security resilience. Trusted by thousands of organisations worldwide, Trustwave leverages its world-class team of security consultants, threat hunters, and researchers, and its market-leading security operations platform to decrease the likelihood of attacks and minimise potential impact. 

Trustwave is an analyst-recognised leader in managed detection and response (MDR), managed security services (MSS), cyber advisory, penetration testing, database security, and email security. The elite Trustwave SpiderLabs team provides industry-defining threat research, intelligence, and threat hunting, all of which are infused into Trustwave services and products to fortify cyber resilience in the age of inevitable cyber-attacks. 

For more information about Trustwave, please visit: https://www.trustwave.com/en-us/.