Threat reportThreat IntelligenceTL-2026-4664
Unit 42: Retail Peak Season Cyber Threats - Ransomware/Extortion, DDoS, Digital Skimming, Account Takeover and AI-Assisted Intrusion (CVE-2024-34102, CVE-2021-44228)
Unit 42: Retail Peak Season Cyber Threats (TL-2026-4664), also tracked as Unwrapping Retail Peak Season Cyber Threats, is a high-severity tracked intrusion set, first published 2026-10-28. It is attributed to Qilin with medium confidence, affects Adobe Adobe Commerce, references 2 CVEs (CVE-2024-34102, CVE-2021-44228), maps to 10 MITRE ATT&CK techniques (T1059.007, T1078.004, T1110.004), and is covered by 9 detection rules and 11 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 10MITRE ATT&CK
- Actors
- 4Qilin
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-4664
- Threat ID
- TL-2026-4664
- Also known as
- Unwrapping Retail Peak Season Cyber Threats, CosmicSting, Jingle Thief
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- Qilin, Akira, ALPHV, ShinyHunters
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- retail, ecommerce, consumer goods, hospitality, payments
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 11
Malware and tooling in Unit 42: Retail Peak Season Cyber Threats
Malware and tooling: AgendaCrypt, BlackCat (Windows), Clop, Dosia, Cairn, Claude (misused frontier LLM)
How Unit 42: Retail Peak Season Cyber Threats works
Unit 42 reports on threats to retail organizations ahead of the 2026 peak shopping season: ransomware and data-theft extortion (565 retail victims claimed as of Sept. 30, 2026; 78% of 2025 extortion incidents involved no encryption), DDoSia DDoS, digital skimming, credential stuffing/account takeover, gift card fraud, and AI-assisted intrusions completed in under 10 hours versus roughly two weeks for human teams.
Unit 42 (Palo Alto Networks) published 'Unwrapping Retail Peak Season Cyber Threats' on 2026-10-28, assessing the threat landscape facing retailers ahead of the holiday season. Holiday sales in 2025 reached roughly $1 trillion in retail and $1.3 trillion online globally, which keeps retail an attractive target. The report splits threats into enterprise-focused (ransomware and extortion, data theft, DDoS, digital skimming, supply chain compromise) and guest-focused (credential stuffing, account takeover, gift card fraud, phishing/smishing) categories, and adds a third category of AI-assisted intrusion.
Ransomware and extortion: 565 retail victims had been claimed on leak sites as of 2026-09-30, with a median victim revenue of about $22 million. Extortion without encryption accounted for 78% of 2025 extortion incidents (down from more than 90% previously). Named actors are TGR-CRI-1173 (The Gentlemen), Spikey Scorpius (Qilin), Howling Scorpius (Akira), Ambitious Scorpius (ALPHV), Bling Libra (ShinyHunters) and Hazy Scorpius (CL0P). Historical retail peak-season incidents cited include Bling Libra theft of hundreds of GB of data in December 2021 and an Ambitious Scorpius (ALPHV) December 2023 incident that stole millions of customer records and disrupted operations.
DDoS and digital skimming: Noname057(16), a pro-Russian hacktivist group, uses the DDoSia botnet (TCP SYN and HTTP GET floods); a December 2025 attack knocked an unnamed retailer's systems offline. For skimming, the report cites CVE-2024-34102 (CosmicSting), an unauthenticated XXE flaw in Adobe Commerce/Magento (CVSS 9.8, CWE-611, added to CISA KEV 2024-07-17). Sansec reported that about 5% of Adobe Commerce/Magento stores were injected with a checkout payment skimmer after CosmicSting exploitation in 2024; attackers stole the Magento crypt key and used the API to modify CMS blocks, and some chained it with CVE-2024-2961 (CNEXT, glibc iconv) for remote code execution. CVE-2021-44228 (Log4Shell, December 2021) is cited as historical peak-season zero-day exploitation context, alongside the December 2020 SolarWinds supply chain compromise.
Account takeover and gift card fraud: Credential stuffing with automated scripts drives loyalty and account takeover (the report cites a December 2022 retailer incident with thousands of loyalty accounts compromised). CL-CRI-1032 (Storm-0539 / Atlas Lion overlap, moderate confidence) ran the 'Jingle Thief' gift card fraud campaign, operating almost entirely in cloud environments after phishing for credentials (Unit 42, October 2025).
AI-assisted intrusion: Unit 42 reports AI-assisted intrusions completed in under 10 hours versus roughly two weeks for human teams. It cites an Anthropic threat intelligence report (September 2026) on Bling Libra's use of Claude, Gambit Security research on an autonomous agent used to steal 600,000+ payment card records, and NorForge research on Cairn, an open-source autonomous penetration testing agent applied to retail e-commerce and POS environments. The article lists no network or file IOCs.
MITRE ATT&CK techniques used in TL-2026-4664
Execution
T1059.007 JavaScript; T1204 User Execution
Initial Access
T1078.004 Cloud Accounts; T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise; T1566 Phishing
Credential Access
Exfiltration
T1567 Exfiltration Over Web Service
Reconnaissance
Impact
Affected products and versions in Unit 42: Retail Peak Season Cyber Threats
- Adobe — Adobe Commerce
Vulnerable versions: 2.4.7 and earlier; 2.4.6-p5 and earlier; 2.4.5-p7 and earlier; 2.4.4-p8 and earlier
Fixed in: Versions in APSB24-40 - Adobe — Magento Open Source
Vulnerable versions: 2.4.7 and earlier; 2.4.6-p5 and earlier; 2.4.5-p7 and earlier; 2.4.4-p8 and earlier
Fixed in: Versions in APSB24-40 - Apache — Log4j2
Vulnerable versions: 2.0-beta9 through 2.14.1
Fixed in: 2.15.0 and later
Remediation for Unit 42: Retail Peak Season Cyber Threats
Patches
- Adobe Security Bulletin APSB24-40 (CVE-2024-34102)
- Apache Log4j 2.15.0 or later (CVE-2021-44228)
Immediate actions
- Patch Adobe Commerce/Magento for CVE-2024-34102 and rotate the Magento crypt key, since patching does not invalidate an already stolen key
- Audit CMS blocks and checkout pages for injected skimmer JavaScript
- Enable dynamic rate-limiting and automated malicious connection filtering ahead of peak season for DDoS resilience
- Enforce MFA and review issuance/approval workflows for gift cards in cloud and SaaS tenants
Workarounds
- Use a WAF/WAAP to inspect XML payloads to Magento REST/API endpoints where patching is delayed
- Use CDN or edge DDoS scrubbing for retail web properties
Longer-term hardening
- Deploy endpoint protection with behavioral analysis and inline sandboxing against ransomware
- Implement zero trust access and enterprise DLP to limit data-theft extortion
- Run continuous attack surface management for internet-facing e-commerce and POS systems
- Deploy WAAP with bot mitigation against credential stuffing and account takeover
- Use CSPM and ASPM for cloud and application posture, and integrate endpoint, network, cloud and identity telemetry with automated triage to cut MTTD/MTTR against AI-accelerated intrusions
CVEs associated with Unit 42: Retail Peak Season Cyber Threats
Weaknesses (CWE) in Unit 42: Retail Peak Season Cyber Threats
Timeline of Unit 42: Retail Peak Season Cyber Threats
- Bling Libra (ShinyHunters) steals hundreds of GB of data (emails, passwords, invoices, employee files) from an unnamed retailer during the December 2021 holiday period (month-level date per Unit 42).
- CVE-2021-44228 (Log4Shell) zero-day exploitation begins in December 2021; cited by Unit 42 as historical peak-season exploitation context (approximate date; the original disclosure date is in public Log4j advisories).
- Ambitious Scorpius (ALPHV) steals millions of customer records and disrupts operations at an unnamed retailer in December 2023 (month-level date).
- CVE-2024-34102 (CosmicSting), an unauthenticated XXE vulnerability in Adobe Commerce/Magento with CVSS 9.8, is published.
- CISA adds CVE-2024-34102 to the Known Exploited Vulnerabilities catalog (remediation due 2024-08-07).
- Per Unit 42, about 5% of online stores are affected by CosmicSting-enabled payment skimming in October 2024 (month-level date).
- Unit 42 documents CL-CRI-1032 (Storm-0539 / Atlas Lion overlap), the Jingle Thief cloud-based gift card fraud campaign, in October 2025 (month-level date).
- Noname057(16) uses DDoSia to knock an unnamed retailer's systems offline in December 2025 (month-level date).
- 565 retail organizations have been claimed as ransomware/extortion victims in 2026 as of this date.
- Unit 42 publishes 'Unwrapping Retail Peak Season Cyber Threats'.
Sources cited for Unit 42: Retail Peak Season Cyber Threats
- Unwrapping Retail Peak Season Cyber Threats
- NVD - CVE-2024-34102
- CISA Known Exploited Vulnerabilities Catalog (CVE-2024-34102 added 2024-07-17)
- Adobe Security Bulletin APSB24-40
- Thousands of Adobe Commerce stores hacked in competing CosmicSting campaigns (Sansec)
- Alert: Adobe Commerce and Magento Stores Under Attack (The Hacker News)
- Cloud-Based Gift Card Fraud Campaign (Unit 42, Jingle Thief / CL-CRI-1032)
- Jingle Thief Hackers Exploit Cloud Infrastructure (The Hacker News)
- Anatomy of DDoSia: NoName057(16)'s DDoS Infrastructure and Targeting (Recorded Future)
Detection coverage for TL-2026-4664
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4664 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.