# Unit 42: Retail Peak Season Cyber Threats - Ransomware/Extortion, DDoS, Digital Skimming, Account Takeover and AI-Assisted Intrusion (CVE-2024-34102, CVE-2021-44228)

> Unit 42 reports on threats to retail organizations ahead of the 2026 peak shopping season: ransomware and data-theft extortion (565 retail victims claimed as of Sept. 30, 2026; 78% of 2025 extortion incidents involved no encryption), DDoSia DDoS, digital skimming, credential stuffing/account takeover, gift card fraud, and AI-assisted intrusions completed in under 10 hours versus roughly two weeks for human teams.

- **Published:** 2026-10-28T18:25:47Z
- **Last reviewed:** 2026-10-28T18:25:47Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4664
- **ID:** TL-2026-4664
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Qilin
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-34102, CVE-2021-44228

## Description

Unit 42 (Palo Alto Networks) published 'Unwrapping Retail Peak Season Cyber Threats' on 2026-10-28, assessing the threat landscape facing retailers ahead of the holiday season. Holiday sales in 2025 reached roughly $1 trillion in retail and $1.3 trillion online globally, which keeps retail an attractive target. The report splits threats into enterprise-focused (ransomware and extortion, data theft, DDoS, digital skimming, supply chain compromise) and guest-focused (credential stuffing, account takeover, gift card fraud, phishing/smishing) categories, and adds a third category of AI-assisted intrusion.

Ransomware and extortion: 565 retail victims had been claimed on leak sites as of 2026-09-30, with a median victim revenue of about $22 million. Extortion without encryption accounted for 78% of 2025 extortion incidents (down from more than 90% previously). Named actors are TGR-CRI-1173 (The Gentlemen), Spikey Scorpius (Qilin), Howling Scorpius (Akira), Ambitious Scorpius (ALPHV), Bling Libra (ShinyHunters) and Hazy Scorpius (CL0P). Historical retail peak-season incidents cited include Bling Libra theft of hundreds of GB of data in December 2021 and an Ambitious Scorpius (ALPHV) December 2023 incident that stole millions of customer records and disrupted operations.

DDoS and digital skimming: Noname057(16), a pro-Russian hacktivist group, uses the DDoSia botnet (TCP SYN and HTTP GET floods); a December 2025 attack knocked an unnamed retailer's systems offline. For skimming, the report cites CVE-2024-34102 (CosmicSting), an unauthenticated XXE flaw in Adobe Commerce/Magento (CVSS 9.8, CWE-611, added to CISA KEV 2024-07-17). Sansec reported that about 5% of Adobe Commerce/Magento stores were injected with a checkout payment skimmer after CosmicSting exploitation in 2024; attackers stole the Magento crypt key and used the API to modify CMS blocks, and some chained it with CVE-2024-2961 (CNEXT, glibc iconv) for remote code execution. CVE-2021-44228 (Log4Shell, December 2021) is cited as historical peak-season zero-day exploitation context, alongside the December 2020 SolarWinds supply chain compromise.

Account takeover and gift card fraud: Credential stuffing with automated scripts drives loyalty and account takeover (the report cites a December 2022 retailer incident with thousands of loyalty accounts compromised). CL-CRI-1032 (Storm-0539 / Atlas Lion overlap, moderate confidence) ran the 'Jingle Thief' gift card fraud campaign, operating almost entirely in cloud environments after phishing for credentials (Unit 42, October 2025).

AI-assisted intrusion: Unit 42 reports AI-assisted intrusions completed in under 10 hours versus roughly two weeks for human teams. It cites an Anthropic threat intelligence report (September 2026) on Bling Libra's use of Claude, Gambit Security research on an autonomous agent used to steal 600,000+ payment card records, and NorForge research on Cairn, an open-source autonomous penetration testing agent applied to retail e-commerce and POS environments. The article lists no network or file IOCs.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1195 Supply Chain Compromise
- T1078.004 Cloud Accounts
- T1059.007 JavaScript
- T1204 User Execution
- T1110.004 Credential Stuffing
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Unwrapping Retail Peak Season Cyber Threats](https://unit42.paloaltonetworks.com/unwrapping-retail-cyber-threats/)
- [NVD - CVE-2024-34102](https://nvd.nist.gov/vuln/detail/CVE-2024-34102)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2024-34102 added 2024-07-17)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Adobe Security Bulletin APSB24-40](https://helpx.adobe.com/security/products/magento/apsb24-40.html)
- [Thousands of Adobe Commerce stores hacked in competing CosmicSting campaigns (Sansec)](https://sansec.io/research/cosmicsting-fallout)
- [Alert: Adobe Commerce and Magento Stores Under Attack (The Hacker News)](https://thehackernews.com/2024/10/alert-adobe-commerce-and-magento-stores.html)
- [Cloud-Based Gift Card Fraud Campaign (Unit 42, Jingle Thief / CL-CRI-1032)](https://unit42.paloaltonetworks.com/cloud-based-gift-card-fraud-campaign/)
- [Jingle Thief Hackers Exploit Cloud Infrastructure (The Hacker News)](https://thehackernews.com/2025/10/jingle-thief-hackers-exploit-cloud.html)
- [Anatomy of DDoSia: NoName057(16)'s DDoS Infrastructure and Targeting (Recorded Future)](https://www.recordedfuture.com/research/anatomy-of-ddosia)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4664