Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Unwrapping Retail Peak Season Cyber Threats

Summary: Unit 42 reports that ransomware operators have claimed 565 retail organizations as victims in 2026, with a median victim revenue around $22 million, and names TGR-CRI-1173 (The Gentlemen), Spikey Scorpius (Qilin) and Howling Scorpius (Akira) as the top three operators claiming retail victims. The blog also recounts prior peak-season incidents, including the December 2025 DDoS by Noname057(16) using the DDoSia botnet, the October 2024 CosmicSting (CVE-2024-34102) skimming campaign affecting roughly 5% of online stores on prominent e-commerce platforms, and a 2026 Unit 42 incident in which a human attacker used frontier AI models to conduct an intrusion in under 10 hours that would typically have taken multiple operators at least two weeks.

What you should know: An intrusion compressed from two weeks to under 10 hours leaves little room for a security team whose detection and response still runs in hours, and it lands in a season when code freezes limit the changes retailers can make to critical systems.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related