Q3 2022 Retail Sector: Quarterly Threat Landscape Scorecard

Q3 2022 Retail Sector: Quarterly Threat Landscape Scorecard

Product Serial: A-2022-10-31b

TLP: CLEAR

ZeroFox Intelligence is excited to announce the release of our Retail Quarterly Threat Landscape Scorecard for Q3 of 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on October 10, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

The threat to retail sector organizations in Q3 2022 remained broadly consistent with previous quarters, with the ongoing war in Ukraine continuing to shape the cyber threat landscape. Retail organizations faced an increased threat from smishing, callback phishing, and threat actors leveraging techniques to bypass multi-factor authentication (MFA). ZeroFox Intelligence recommends implementing phishing-resistant MFA methods that support Fast ID Online Version 2. (FIDO2) and certificate-based authentication. The sustained high pace of vulnerability disclosure, including in widely-used e-commerce platforms, will very likely strain out-of-cycle patch management processes and increases the risk of vulnerabilities not being patched in a timely manner. The shift to Initial Access Broker (IAB) market sales being made in private channels rather than advertising in open forums will likely continue and make identifying and mitigating access sales ahead of compromise increasingly challenging. Botnet and malware deployment remained high, including infostealers and trojans. Digital extortion attempts against retail targets remain below 2021 levels, likely caused in part by difficulty eliciting payments from victims. Incidents in Q3 2022 highlighted the high threat of attacks against third-party providers that could implicate multiple downstream customers.

Key Findings

• Retail organizations likely face an increased threat of smishing, callback phishing (vishing), and phishing techniques that bypass MFA.
• Vulnerabilities in widely-used ecommerce platforms were leveraged in attacks against the retail sector, long after patches were released.
• Illicit access to retail entities was increasingly being sold via private or direct communication channels.
• E-skimmers and other malware continued to be deployed at a high frequency against payment systems.
• Ransomware and digital extortion attempts against the retail sector this quarter highlighted the threat of attacks against third-party providers.