Retail threat intelligence report — 16–22 May 2026

• Reference: TI-2026-0522-004 (public edition)
• Sector: Retail
• Reporting period: 16–22 May 2026
• Issued: 22 May 2026 · Lead analyst: Peter Bassill · Reviewed by: SOC Duty Senior Analyst

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

This report assesses the threat landscape affecting the Retail vertical for the period 16 May 2026 to 22 May 2026. The reporting cycle has been shaped by sustained Scattered Spider / DragonForce cartel activity following the M&S, Co-op and Harrods incidents of April–May 2025, continued exploitation of edge-appliance CVEs, and the consolidation of the IAB-into-RaaS economic model that materially extended the 2025 retail attack wave into 2026.

Key Judgements

The following key judgements represent the lead analyst's assessed view at the time of issue. Each is qualified by an analytic confidence rating in line with the conventions described in Section 11.

• It is highly likely that the Scattered Spider / DragonForce alliance will continue to produce material UK retail incidents through 2026, with the IT helpdesk and BPO supply-chain remaining the dominant entry vector. (HIGH confidence)
• It is likely that at least one further UK or EU retailer of comparable scale to M&S will publicly disclose a disruptive ransomware event before the end of Q3 2026. (MEDIUM confidence)
• It is highly likely that double-extortion will remain the dominant business model for retail-targeted ransomware, with operational disruption (warehouse stoppage, EPOS / payments downtime, online-order suspension) being the principal lever rather than data theft alone. (HIGH confidence)
• It is likely that the third-party-IT-supplier weakness exposed by the M&S incident (where the TCS-operated helpdesk was the entry point) will continue to be exploited against UK retailers using similarly-structured outsourcing arrangements. (MEDIUM confidence)
• There is a realistic possibility that the 2026 Christmas-trading window will be specifically targeted by cartel-aligned operators for maximum retailer ransom leverage, mirroring the operational pattern observed in 2024 and 2025. (MEDIUM confidence)

2. Sector threat landscape

The retail vertical's threat picture remains dominated by the consequences of the April–May 2025 Scattered Spider / DragonForce campaign against UK retailers. M&S sustained a multi-week operational disruption (online-order suspension, contactless-payment failures, warehouse staff stood down, an estimated £30m immediate profit loss plus £15m/week of continued lost profit until restoration, and a market-cap impact at one point of approximately £750 million). Co-op and Harrods sustained adjacent incidents within days. The entry vector at M&S was via the TCS-operated outsourced helpdesk — a model still in use across multiple UK retailers, which sustains the credibility of the threat into 2026.

Operationally, the alliance has matured into a coherent multi-strand operation. Scattered Spider as the IAB front-end performs the social-engineering against helpdesks and identity providers; DragonForce / LockBit / Qilin provide the post-compromise ransomware payload and the leak-site for double-extortion; the cartel-style structure means that an attack presents either with cartel-affiliated cosmetic features or as bespoke-looking activity, depending on which affiliate is running the operation. The defensive challenge is that the social-engineering signature is robust but operationally undetectable until the post-call lateral movement begins.

Beyond the cartel cluster, retail remains a recurring target for Akira (operational tempo and ESXi-aware payload), Qilin (sustained leak-site cadence including retail victims), and TheGentlemen (rapid affiliate growth, 424 named victims by 18 May 2026). Cl0p exposure for retail is reduced compared to 2023 — managed-file-transfer-anchored extortion is now less operationally relevant to the retail estate — but the residual victim disclosures from earlier campaigns continue to surface.

From a vulnerability perspective, the May 2026 vulnerability picture for retail is dominated by Cisco Catalyst SD-WAN (CVE-2026-20182, active ITW exploitation by UAT-8616), Ivanti EPMM (CVE-2026-6973, in CISA KEV from 7 May 2026), Trend Micro Apex One (CVE-2026-34926, added to CISA KEV on 21 May 2026) and Citrix NetScaler (CVE-2026-3055 / 4368). Retail estates that lean on any of these as the perimeter or remote-access stack should treat the next reporting cycle as the operational window for emergency patching.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the named vertical during the reporting period. Profiles below are repeated for each actor; established actors with no fresh activity in the reporting period are referenced briefly in Section 2 without a full profile.

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period. The corresponding behaviour column summarises the activity in operational terms suitable for use in detection engineering and threat hunting.

5. Notable incidents and campaigns

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of the affected product in client estates, and the operational exposure of the typical deployment.

7. Indicators of compromise

The following indicators are provided to support detection engineering and threat hunting within client environments. Indicators are defanged in line with industry convention. Confidence ratings reflect the strength of the underlying corroboration and the lifetime of the indicator type.

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical. The composite rating reflects the product of likelihood and impact over the next reporting cycle.

9. Recommended defensive actions

The recommendations below are organised against the three operational pillars of Detect, Defend, and Disrupt. They are intended to be actionable within a typical client environment within the next reporting cycle and should be prioritised in line with the risk assessment in Section 8.

Detect

• Helpdesk-impersonation telemetry: instrument the outsourced helpdesk channel for callback verification, voice-biometric or shared-secret challenge, and alert on any admin password-reset performed without secondary verification.
• M365 identity-provider telemetry: alert on impossible-travel, new device registration on admin accounts, and OAuth consent grants from non-admin users.
• ESXi / vSphere management-plane telemetry: alert on new SSH sessions outside the documented admin source-range; alert on vSphere admin login from previously-unseen user-agent.
• Edge-appliance telemetry per CISA / NCSC joint guidance on Cisco SD-WAN, Ivanti EPMM and Citrix NetScaler.

Defend

• Patch Cisco SD-WAN, Ivanti EPMM, Trend Micro Apex One, Citrix NetScaler and apply May 2026 Microsoft Patch Tuesday roll-up across the retailer estate before the next reporting cycle.
• Tighten the outsourced-helpdesk control package — callback-via-trusted-channel for password resets, voice-biometric or shared-secret challenge for admin actions, and tabletop the helpdesk against an explicit Scattered Spider scenario before quarter close.
• Enforce number-matching MFA on Microsoft Authenticator and remove push-approve where possible; disable SMS-based MFA on admin accounts; require FIDO2 keys for all M365 / identity-provider admin accounts.
• Validate offline / immutable backup for the e-commerce, EPOS, payments and WMS estates against a Christmas-trading-window ransomware scenario within the next reporting cycle.

Disrupt

• Subscribe to RH-ISAC (Retail and Hospitality ISAC) and contribute observed indicators.
• Push indicators in Section 7 into preventive controls via the ipinsights.io TAXII 2.1 endpoint.
• Tabletop a Christmas-trading-window ransomware scenario explicitly — the 2026 trading calendar makes this the highest-leverage operational test for the year.

10. Forward outlook

It is highly likely that further UK retail cartel-affiliated ransomware events will be publicly disclosed before end of Q3 2026. (HIGH confidence)

It is likely that the 2026 Christmas-trading window will be specifically targeted by cartel-aligned operators; preposition planning and incident-response capacity for November–December. (MEDIUM confidence)

Trigger conditions warranting forecast revision: a confirmed retail-sector exploitation of CVE-2026-20182 / CVE-2026-6973; a third UK retailer disclosing a Scattered-Spider-attributed incident in the same quarter; or a public attribution shift away from English-speaking IAB front-ends towards a new affiliate community.

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst's assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence from multiple reliable sources with limited ambiguity; MEDIUM indicates partially-corroborated evidence with some logical inference; LOW indicates limited or fragmentary evidence requiring careful onward use. Estimative language follows the conventions of UK intelligence writing — "almost certainly", "highly likely", "likely", "realistic possibility", "unlikely", "highly unlikely" — and is used in preference to numerical probability bands.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for the convenience of recipients.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System (see Section 11).

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.