Retail threat landscape
Retailers, e-commerce and point-of-sale estates — card data, credential stuffing and seasonal extortion pressure.
Matched automatically by keyword — not by AI or analyst judgement. Rebuilt daily. Last rebuilt 2026-10-20.
- Threat actors
- 6
- Actively-attacked vulnerabilities (CISA KEV)
- 1
- Ransomware victims, last 90 days
- 169
- Ransomware victims, since 2026-06
- 275
Threat actors
Actors whose feed descriptions reference this sector, ranked by graph connectivity.
| Actor | What the feeds say | Connections in our data |
|---|---|---|
| Scattered Spider | Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. T… | 423 |
| FIN7 | FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, fin… | 366 |
| APT41 | APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, [APT41](https://atta… | 210 |
| FIN6 | FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in t… | 173 |
| FIN8 | FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology,… | 166 |
| FIN13 | FIN13 is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and Latin America, as early as 2016. [FIN13](https://attack.mitre.org… | 145 |
Campaigns
Campaigns and intel pulses mentioning this sector, most recent first. Showing 15 of 26.
| Campaign | Description | Linked actors | Seen |
|---|---|---|---|
| Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM | Settra is a ransomware variant first observed in June 2026 that targets organizations through VPNs or compromised credentials. Two incidents were investigated in July and September 2026, affecting the consumer services, retail, and manufact… | — | 2026-10-17 |
| DragonForce Ransomware Profile: From Affiliate Program to Cybercrime Cartel | DragonForce is a financially motivated ransomware operation that emerged in August 2023, initially using leaked LockBit 3.0 code and later transitioning to Conti v3-based variants. Operating as a Ransomware-as-a-Service model, they offer af… | — | 2026-10-15 |
| StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack | An unpatched zero-day vulnerability dubbed StyleSmuggler affects all current versions of Magento and Adobe Commerce, including 2.4.9, enabling unauthenticated remote code execution. Active exploitation began on September 4th, 2026. The atta… | — | 2026-10-07 |
| Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access | Attackers who gain access to AWS credentials perform validation to determine their usefulness, particularly for Amazon Bedrock access. Multiple credential harvesting platforms, including KMON_NOC, have been identified that specifically test… | — | 2026-10-07 |
| Implants in the Supply Chain | Three distinct implants—SPEAKINGSTONE, DARKLANTERN, and ENDLESSDOORS—have been discovered embedded in ZBT router firmware distributed through a global supply chain reaching the United States, Canada, Australia, Philippines, Germany, and Rus… | — | 2026-09-26 |
| Search results are sending people to fake Bitrefill checkouts | Cybercriminals have created numerous fake websites mimicking Bitrefill, a legitimate cryptocurrency-based gift card and eSIM retailer. These fraudulent sites appear in search engine results and use lookalike domains incorporating the Bitref… | — | 2026-09-15 |
| GrelosGTM group abuses Google Tag Manager to attack e-commerce websites | A cybercriminal group dubbed GrelosGTM has been exploiting Google Tag Manager's legitimate functionality to compromise e-commerce websites. First detected in early April 2020, the group evolved their tactics by February 2021 to inject malic… | — | 2026-09-15 |
| Inside a Ukrainian IP Camera Toolkit | Two open directories hosted on Russian bulletproof infrastructure revealed coordinated operations targeting Ukrainian IP cameras, routers, and government websites. The first server exposed tools exploiting SQL injection against a Ukrainian… | — | 2026-09-12 |
| Financially Motivated Threat Actor BREEZE COMET Targets Brazil | Beginning in 2024, a financially motivated threat actor designated BREEZE COMET has conducted sophisticated operations targeting Brazilian financial services, retail, and eCommerce organizations. The group specializes in manipulating paymen… | — | 2026-09-03 |
| Financially Motivated Threat Actor Targets Brazil | Beginning in 2024, a financially motivated threat actor designated BREEZE COMET has conducted sophisticated operations targeting Brazilian financial services, retail, and eCommerce organizations. The group specializes in manipulating paymen… | — | 2026-09-01 |
| Skimming on the Blockchain: A Magecart Campaign That Uses EtherHiding, Found by Malvertising Scanning | A sophisticated card-skimming operation targets e-commerce platforms by combining client-side payment skimming with EtherHiding techniques, staging payloads inside Ethereum blockchain smart-contract storage. The attackers compromise legitim… | — | 2026-08-31 |
| Back-to-School Cyber Risks Surge as Education Remains the World's Most Attacked Sector | Educational institutions continue to be the most targeted sector globally, experiencing an average of 4,696 weekly cyberattacks per organization between January and July 2026, representing an 8% increase year-over-year and more than double… | — | 2026-08-20 |
| Defending SaaS-based applications against ShinyHunters OAuth abuse | Between mid-2025 and mid-2026, threat actors using tradecraft associated with ShinyHunters targeted customer SaaS applications, particularly Salesforce instances, through three primary intrusion paths. Voice phishing campaigns impersonated… | — | 2026-08-13 |
| Contagious Interview malware in SVG images: DPRK campaign | A DPRK-aligned threat group is targeting developers through fake job postings and coding challenges in a campaign tracked as REF9403. Attackers post fake job offers in developer forums, then send trojanized repositories containing fully fun… | — | 2026-07-17 |
| The Devil, Eight Million Emails, and a Whole Lot of Milk | Phishing Stager Exposed | On May 15, 2026, Huntress agents detected an intrusion where threat actors compromised a terminal server to stage a massive phishing campaign rather than deploy ransomware. The attacker used legitimate bulk email software (Gammadyne Mailer)… | — | 2026-07-15 |
ATT&CK techniques
Techniques used by the actors above — what to detect for, ranked by how many of them use it. Showing 15 of 197.
Known-exploited CVEs
CISA KEV entries whose vendor, product or description matches this sector — 1 total, latest below.
| CVE | Vulnerability | Vendor / product | KEV added |
|---|---|---|---|
| CVE-2020-2555 | Oracle Multiple Products Remote Code Execution Vulnerability | Oracle · Multiple Products | 2021-11-03 |
High-severity CVEs
Vulnerabilities whose descriptions reference this sector, by CVSS.
| CVE | CVSS | Description | KEV |
|---|---|---|---|
| CVE-2025-10656 | 9.8 | The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.37 vi the user_filter function. This makes it … | |
| CVE-2020-2555 | 9.8 | Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherenc… | KEV |
| CVE-2025-11024 | 9.8 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows Blind SQL Injection. This issue affects E-Co… | |
| CVE-2026-108065 | 9.8 | SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauthenticated remote attacker to read, write, and potentially … | |
| CVE-2025-6577 | 9.8 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows SQL Injection. This issue affects E-Commerce… | |
| CVE-2024-31823 | 9.8 | An issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the removeSecondaryImage method of the Publish.php component.… | |
| CVE-2025-65336 | 9.8 | Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php.… | |
| CVE-2026-54612 | 8.8 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements() in admin/controller/editor/global-trait.php concatenates the attacker… | |
| CVE-2026-49228 | 8.8 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another… | |
| CVE-2026-59109 | 8.8 | SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenat… | |
| CVE-2025-9216 | 8.8 | The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import() f… | |
| CVE-2025-68434 | 8.8 | Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Cross-Site Request Forgery (CSRF) vul… | |
| CVE-2025-14390 | 8.8 | The Video Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in version <= 5.0.4. This is due to missing or incorrect nonce validation on the video_merchant_add_video_file() function. This makes it… | |
| CVE-2026-49221 | 8.8 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operations allow a low-privileged Vendor to access digital assets link… | |
| CVE-2026-77183 | 8.8 | The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.43.0. This is due to the plugin not properly vali… |
Ransomware victims
Named leak-site victims classified into this sector (ransomware.live taxonomy: Retail & E-Commerce / Retail), latest 15 shown.
| Victim | Crew | Discovered |
|---|---|---|
| BW Office World | payload | 2026-10-20 |
| chooseultimate.com | lockbit5 | 2026-10-19 |
| Froggys Fog | N0n | 2026-10-19 |
| Belcorp | qilin | 2026-10-18 |
| Decorolala - 500 Line Sample | BYOD | 2026-10-17 |
| Verano Holdings | THE SEVEN DEADLY SINS | 2026-10-16 |
| Chattanooga Shooting Supplies | qilin | 2026-10-15 |
| Enchanted Fine Jewellery | Vexy Ransomware | 2026-10-15 |
| buckle | iah6477 | 2026-10-15 |
| Shediac Lobster Shop | akira | 2026-10-14 |
| Estrategias BigMat S.L.U. | aurora | 2026-10-14 |
| ocean beverages | HYFLOCK | 2026-10-13 |
| MarieBelle New York | N0n | 2026-10-13 |
| Decorolala | BYOD | 2026-10-13 |
| Claire's Inc. | Dark Project | 2026-10-12 |
Most active crews · since 2026-06
watch this sector
Get a daily email when something new touches retail — or your own vendors, products and suppliers. Deterministic graph matches, one email a day, one-click unsubscribe.