Retail threat intelligence report — 30 May – 5 June 2026

• Reference: TI-2026-0605-004 (public edition)
• Sector: Retail
• Reporting period: 30 May – 5 June 2026
• Issued: 5 June 2026 · Lead analyst: Peter Bassill · Reviewed by: SOC Duty Senior Analyst

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

The retail collection picture this week has been dominated by the continuing fallout from the 2025 Scattered Spider / DragonForce campaign against UK retailers, with M&S, Co-op and Harrods continuing to feature in trade-press analysis of the cyber-loss cycle. The addition of CVE-2026-45247 (Mirasvit Full Page Cache Warmer, Magento) to KEV on 03 June is acutely relevant to the vertical: any UK retailer running a Magento or Adobe Commerce storefront with Mirasvit modules should treat the cache-warmer endpoint as a candidate compromise pending patch verification. Continuing edge-appliance exploitation against Fortinet EMS (CVE-2026-35616), Cisco SD-WAN (CVE-2026-20182) and Exchange OWA (CVE-2026-42897) all carry direct retail relevance.

Perimeter scrubbing was dominated by sustained brute-force pressure against SSH and CMS surfaces from the standing IP Insights 'critical' tail. May 2026 leak-site telemetry from BreachSense placed retail in the top five sub-sectors by posting volume, with Qilin and DragonForce as the dominant brand-name threats.

Key Judgements

The following key judgements represent the lead analyst’s assessed view at the time of issue. Each is qualified by an analytic confidence rating in line with the conventions described in Section 11.

1. It is highly likely that ransomware and IAB activity against UK and EU retailers will continue at the elevated 2026 cadence, with Scattered Spider continuing as the dominant English-speaking IAB front-end and Qilin / DragonForce as the principal extortion brands. (HIGH confidence)
2. It is highly likely that CVE-2026-45247 (Mirasvit / Magento) will be exploited against UK retailers running affected modules within the next reporting cycle, with consequences ranging from Magecart-style cardholder-data theft to full storefront compromise. (HIGH confidence)
3. It is likely that CVE-2026-35616 (Fortinet FortiClient EMS) will be exploited against retail estates over the next two reporting cycles, given the prevalence of FortiClient EMS in distributed-retail head-office and DC environments. (MEDIUM-HIGH confidence)
4. It is highly likely that helpdesk-impersonation vishing against retail IT support and outsourced contact-centres will continue at the cadence observed in 2025, with credential-reset and MFA-bypass as the primary objectives. (HIGH confidence)
5. It is likely that POS-malware and skimmer-implant activity against UK retailers will produce at least one confirmed cardholder-data exfiltration disclosure in the next reporting cycle. (MEDIUM confidence)

2. Sector threat landscape

The retail vertical continues to define the UK ransomware-loss narrative on account of the M&S, Co-op and Harrods incidents through April-May 2025. M&S's annual results, published 20 May, confirmed cyber-attack cost of GBP 300m and a 23.8% reduction in adjusted pre-tax profit; the trade press has continued to use the case as the reference for the 2026 cycle. BreachSense's May 2026 retrospective places retail in the top five sub-sectors by leak-site posting volume.

The most operationally consequential single development this week is the addition of CVE-2026-45247 (Mirasvit Full Page Cache Warmer) to CISA KEV on 03 June. Mirasvit modules are widely deployed across Magento and Adobe Commerce storefronts, including in the UK mid-market; the deserialisation primitive against the cache-warmer endpoint is acutely valuable to attackers and should be treated as actively exploited. Retailers running affected modules should treat the cache-warmer endpoint as a candidate compromise pending patch verification.

Edge-appliance and identity-provider exposure remains the principal IT-side initial-access route. Fortinet FortiClient EMS (CVE-2026-35616), Cisco Catalyst SD-WAN (CVE-2026-20182) and Microsoft Exchange OWA (CVE-2026-42897) are all relevant to UK retail head-office estates. Scattered Spider continuing tradecraft against retail IT helpdesks and outsourced contact-centres remains the dominant credential-driven initial-access pattern.

POS-malware and skimmer-implant activity continues at a steady-state cadence against UK retailers. The Retail and Hospitality ISAC (RH-ISAC) reports a continuing rise in JavaScript-skimmer (Magecart-style) infrastructure, with the addition of Mirasvit to KEV likely to accelerate this trend in the next reporting cycle.

Perimeter scrubbing handled sustained brute-force pressure from the standing IP Insights 'critical' tail - none successful.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the named vertical during the reporting period. The profile block below should be repeated, in full, for each actor profiled. Prioritise actors for whom new or sector-relevant activity has been observed within the reporting period; established actors with no recent activity may be referenced briefly without a full profile.

Scattered Spider / DragonForce affiliate cluster

• Aliases: UNC3944, Octo Tempest, Muddled Libra, 0ktapus, Scatter Swine
• Suspected Origin: UK / US / English-speaking community
• Suspected Sponsor: Criminal (IAB into DragonForce / Qilin)
• Primary Motivation: Financial - extortion via partner ransomware
• Sector Targeting: Cross-sector with sustained Retail relevance.
• Geographic Focus: UK, US, increasing EU
• Signature TTPs: Voice-phishing of IT helpdesks; SIM-swap; OAuth consent-phish; RMM abuse
• Tooling / Malware Families: DragonForce / Qilin partner encryptors; ESXi mass-encryption
• Recent Activity: Continuing focus on retail IT helpdesks and outsourced contact-centres; defined the 2025 UK retail loss narrative.
• Assessed Threat to Vertical: HIGH - Admiralty A2.
• Analytic Confidence: HIGH

Qilin (a.k.a. Agenda, Qilin.B)

• Aliases: Agenda, Qilin.B
• Suspected Origin: Russia
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - extortion / data theft
• Sector Targeting: Cross-sector with sustained Retail relevance.
• Geographic Focus: Global; UK, EU, US, ANZ
• Signature TTPs: VPN-credential IAB initial access; ESXi-aware encryptor; double-extortion
• Tooling / Malware Families: Qilin.B encryptor; SystemBC, AnyDesk, rclone
• Recent Activity: 101 victims posted in May 2026 - fifth consecutive month at top of leak-site postings.
• Assessed Threat to Vertical: HIGH - Admiralty B2.
• Analytic Confidence: HIGH

Magecart-style skimmer cluster (multiple actors)

• Aliases: Various
• Suspected Origin: Unattributed
• Suspected Sponsor: Criminal
• Primary Motivation: Financial - cardholder-data theft
• Sector Targeting: Cross-sector with sustained Retail relevance.
• Geographic Focus: Global
• Signature TTPs: JavaScript skimmer implantation via vulnerable Magento / Adobe Commerce modules; Mirasvit primitive plausible new vector
• Tooling / Malware Families: Custom obfuscated JS; bullet-proof hosted exfil endpoints
• Recent Activity: CVE-2026-45247 KEV addition (03 June) elevates near-term threat to retailers running Mirasvit modules.
• Assessed Threat to Vertical: HIGH for affected stack; Admiralty C2.
• Analytic Confidence: MEDIUM

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period. The corresponding behaviours should be cross-referenced to the incidents listed in Section 5 and to detection logic deployed within client environments.

5. Notable incidents and campaigns

Where peer organisations are named, the source of attribution is recorded. Where peer organisations are anonymised, the description is sufficient to convey the operational lessons without identifying the affected party.

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of affected products in the sector, and listing on the CISA Known Exploited Vulnerabilities catalogue. The remediation guidance should be read alongside the recommended actions in Section 9.

7. Indicators of compromise

The following indicators are provided to support detection engineering and threat hunting within client environments. Indicators are defanged in line with industry convention, and confidence ratings reflect the analyst’s assessment of the strength of the association between the indicator and the named actor or campaign. Indicators should be ingested with appropriate decay periods; high-confidence atomic indicators (hashes) generally warrant longer retention than network indicators (IPs, domains).

A machine-readable companion file in STIX 2.1 format is available on request from the lead analyst.

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical. The composite rating is intended to inform prioritisation of defensive investment and is not a substitute for an organisation-specific risk assessment.

9. Recommended defensive actions

The recommendations below are organised against the three operational pillars of Detect, Defend, and Disrupt. They are intended to be actionable within a typical client environment and should be prioritised according to the risk ratings assigned in Section 8 and the operational maturity of the receiving organisation.

Detect

Defend

Preventive priorities: patch any Magento / Adobe Commerce instance running affected Mirasvit modules as the single highest-value action of the cycle, and place the cache-warmer endpoint behind a WAF rule pending closure; patch Fortinet FortiClient EMS to 7.4.2 or later; force MoCAMP 4.18.26040.1011; apply the 14 May Exchange OOB update; verify SD-WAN ED 26-03 closure. Strengthen helpdesk identity-verification scripts and enforce out-of-band verification for any payment-instruction change. Reference RH-ISAC playbooks for storefront-skimmer defence and ISO/IEC 27001 Annex A.5.7, A.8.8 and A.5.23.

Disrupt

Disruption priorities: (i) sustained RH-ISAC participation and indicator exchange, with this week's IP Insights 'critical' tail submitted as the highest-value contribution; (ii) coordinated takedown of skimmer-exfil endpoints via registrar-abuse and Cloudflare trust-and-safety channels; (iii) tabletop exercises around the Scattered Spider helpdesk vector and the storefront-skimmer scenario; (iv) deception deployment around fake storefront admin endpoints.

10. Forward outlook

Looking forward to the next reporting period (06 - 12 June 2026), it is likely that at least one UK retailer will publicly disclose a Mirasvit / Magento exploitation event, with MEDIUM-HIGH confidence based on the breadth of affected estate. It is highly likely that Scattered Spider helpdesk-impersonation activity will continue at the current cadence. It is a realistic possibility that a POS-malware or skimmer-implant incident against a UK retailer will be disclosed within the cycle.

Trigger conditions that would prompt revision include: (a) a UK retailer publicly attributing a breach to Mirasvit / Magento exploitation; (b) an RH-ISAC TLP:CLEAR advisory pointing to a sector-wide skimmer campaign; (c) novel Scattered Spider tradecraft confirmed by NCSC-UK.

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst’s assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence drawn from multiple credible sources and a strong analytic line of reasoning; MEDIUM indicates plausibility supported by partial corroboration or sound analytic inference; LOW indicates limited evidence, single-sourcing, or significant uncertainty in the underlying data. Where confidence is LOW, the rationale is recorded in the body of the report rather than allowed to stand unexamined.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for reference.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System.

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.