EN PT-BR
← Voltar ao feed
medium retail e-commerce

Unit 42 outlines retail peak-season cyber threats for 2026: ransomware, extortion, DDoS, skimming, gift card fraud and AI-driven intrusions

1 fonte(s) · 1 atualização(ões) · publicado 28/10/2026 15:00 · coletado há 4 dias

Unit 42 (Palo Alto Networks) assesses the cyber threats retailers face heading into the 2026 peak shopping season, drawing on past incidents from the same period. As of Sept. 30, 2026, ransomware operators had claimed 565 retail victims that year, with a median victim revenue of about $22 million. The most active groups were TGR-CRI-1173 (The Gentlemen), Qilin (Spikey Scorpius) and Akira (Howling Scorpius). Data-theft extortion by ShinyHunters (Bling Libra) and CL0P (Hazy Scorpius), DDoS by Noname057(16), digital skimming, credential stuffing and gift card fraud by Storm-0539 (CL-CRI-1032) are also highlighted. Unit 42 says its May 2026 prediction that threat actors would weaponize frontier AI models within 3-5 months has come true. It cites an incident where an attacker used AI models to compress an intrusion to under 10 hours.

Entenda a falha

A vulnerabilidade

CVE-2024-34102, nicknamed CosmicSting, is a remote code execution flaw in Adobe Commerce (the story's affected-products field lists Adobe Commerce; the article itself only says 'prominent e-commerce platforms'). According to Unit 42, unspecified actors exploited it against unpatched servers in October 2024. The articles do not say what access or authentication is needed, nor which versions are affected or fixed. The only guidance is to remediate unpatched flaws.

Como funciona

The articles do not explain how the flaw works internally. They describe only the attack sequence: the attackers ran code remotely on unpatched servers, installed persistent backdoors, and then injected payment-skimming scripts into checkout flows. According to Unit 42, this affected roughly 5% of online stores on major e-commerce platforms heading into Black Friday and Cyber Monday.

Como foi descoberta

The article does not say who found the flaw or how it was reported. It only says that unspecified threat actors exploited it in October 2024, so it was exploited in the wild. Unit 42 cites it as an example of digital skimming during peak shopping season, in a retail threat overview published in October 2026.

Explicação gerada por IA a partir da matéria e dos artigos, em 28/10/2026 16:16.

Detalhes técnicos

  • Ransomware: ALPHV (Ambitious Scorpius) stole millions of customer records from a retailer in December 2023, causing delayed fulfillment, canceled e-commerce orders and slowed inventory replenishment.
  • Extortion: In December 2021, Bling Libra stole hundreds of GB from a victim, including customer emails, hashed passwords, payment invoices and employee salary and tax ID files. The 2026 Unit 42 Global IR Report found non-encryption extortion at 78% of incidents in 2025, below 90% for the first time in years.
  • DDoS: In December 2025, Noname057(16) used the DDoSia botnet for TCP SYN and HTTP GET floods against web portals and APIs, knocking systems offline and disrupting package tracking and merchant payments.
  • Digital skimming: In October 2024, unspecified actors exploited the CosmicSting flaw (CVE-2024-34102) for remote code execution, installing backdoors and injecting skimming scripts into checkout flows, affecting roughly 5% of online stores on major e-commerce platforms.
  • Credential stuffing: In December 2022, automated scripts hit a retailer's mobile app and web login APIs, compromising thousands of loyalty accounts. Gift card balances and rewards points were drained, and access was advertised on dark web forums.
  • Gift card fraud: Storm-0539 (Jingle Thief, reported October 2025) phishes and smishes retail employees for credentials, then abuses cloud infrastructure to issue gift cards at scale.
  • AI-enabled attacks: Unit 42 disclosed an intrusion where a human attacker used frontier AI models to automate parts of the attack, finishing in under 10 hours versus an estimated two or more weeks for multiple human operators. Anthropic reported Bling Libra using Claude to speed reconnaissance and exfiltration. Gambit Security reported an attacker using open source harnesses to steal over 600,000 payment card records via JavaScript web skimmers. NorForge reported use of the Cairn autonomous pentesting agent against e-commerce sites, POS infrastructure and web apps.
  • Past events such as SolarWinds (December 2020) and the Log4j zero-day (December 2021) were complicated by holiday code freezes.

Remediação

  • Deploy behavioral endpoint protection, network segmentation, zero trust access and inline sandboxing against ransomware.
  • Use DLP, attack surface management and least-privilege access against data theft.
  • Apply rate limiting, automated mitigation and distributed edge absorption against DDoS.
  • Use WAAP, CSPM and ASPM, patch known flaws and correct configuration drift before code freezes to counter skimming.
  • Use WAAP with bot mitigation and block C2 traffic to counter credential stuffing.
  • Unify endpoint, network, cloud and identity telemetry into automated SecOps to cut MTTD and MTTR from hours to minutes.

Linha do tempo

  1. unit42.paloaltonetworks.com ↗ · pub. 28/10/2026 15:00 · coletado 28/10 16:00 primeiro registro

    Unit 42 outlines retail peak-season cyber threats for 2026: ransomware, extortion, DDoS, skimming, gift card fraud and AI-driven intrusions

    ler a análise desta fonte

    Unit 42 (Palo Alto Networks) assesses the cyber threats retailers face heading into the 2026 peak shopping season, drawing on past incidents from the same period. As of Sept. 30, 2026, ransomware operators had claimed 565 retail victims that year, with a median victim revenue of about $22 million. The most active groups were TGR-CRI-1173 (The Gentlemen), Qilin (Spikey Scorpius) and Akira (Howling Scorpius). Data-theft extortion by ShinyHunters (Bling Libra) and CL0P (Hazy Scorpius), DDoS by Noname057(16), digital skimming, credential stuffing and gift card fraud by Storm-0539 (CL-CRI-1032) are also highlighted. Unit 42 says its May 2026 prediction that threat actors would weaponize frontier AI models within 3-5 months has come true. It cites an incident where an attacker used AI models to compress an intrusion to under 10 hours.

    Technical Details

    • Ransomware: ALPHV (Ambitious Scorpius) stole millions of customer records from a retailer in December 2023, causing delayed fulfillment, canceled e-commerce orders and slowed inventory replenishment.
    • Extortion: In December 2021, Bling Libra stole hundreds of GB from a victim, including customer emails, hashed passwords, payment invoices and employee salary and tax ID files. The 2026 Unit 42 Global IR Report found non-encryption extortion at 78% of incidents in 2025, below 90% for the first time in years.
    • DDoS: In December 2025, Noname057(16) used the DDoSia botnet for TCP SYN and HTTP GET floods against web portals and APIs, knocking systems offline and disrupting package tracking and merchant payments.
    • Digital skimming: In October 2024, unspecified actors exploited the CosmicSting flaw (CVE-2024-34102) for remote code execution, installing backdoors and injecting skimming scripts into checkout flows, affecting roughly 5% of online stores on major e-commerce platforms.
    • Credential stuffing: In December 2022, automated scripts hit a retailer's mobile app and web login APIs, compromising thousands of loyalty accounts. Gift card balances and rewards points were drained, and access was advertised on dark web forums.
    • Gift card fraud: Storm-0539 (Jingle Thief, reported October 2025) phishes and smishes retail employees for credentials, then abuses cloud infrastructure to issue gift cards at scale.
    • AI-enabled attacks: Unit 42 disclosed an intrusion where a human attacker used frontier AI models to automate parts of the attack, finishing in under 10 hours versus an estimated two or more weeks for multiple human operators. Anthropic reported Bling Libra using Claude to speed reconnaissance and exfiltration. Gambit Security reported an attacker using open source harnesses to steal over 600,000 payment card records via JavaScript web skimmers. NorForge reported use of the Cairn autonomous pentesting agent against e-commerce sites, POS infrastructure and web apps.
    • Past events such as SolarWinds (December 2020) and the Log4j zero-day (December 2021) were complicated by holiday code freezes.

    Remediation

    • Deploy behavioral endpoint protection, network segmentation, zero trust access and inline sandboxing against ransomware.
    • Use DLP, attack surface management and least-privilege access against data theft.
    • Apply rate limiting, automated mitigation and distributed edge absorption against DDoS.
    • Use WAAP, CSPM and ASPM, patch known flaws and correct configuration drift before code freezes to counter skimming.
    • Use WAAP with bot mitigation and block C2 traffic to counter credential stuffing.
    • Unify endpoint, network, cloud and identity telemetry into automated SecOps to cut MTTD and MTTR from hours to minutes.