Retail threat intelligence report — 6–12 June 2026

• Reference: TI-2026-0612-004 (public edition)
• Sector: Retail
• Reporting period: 6–12 June 2026
• Issued: 12 June 2026 · Lead analyst: Peter Bassill · Reviewed by: SOC Duty Senior Analyst

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

This report provides an assessment of the threat landscape affecting the Retail sector during the period 06 Jun 2026 - 12 Jun 2026. It is intended to support security leadership and operational defenders within the vertical and is issued under TLP:CLEAR.

The retail-sector collection picture this week continues to be framed by the Scattered Spider / DragonForce campaign that disrupted M&S, Co-op and Harrods through April-May 2025 and which has carried forward into a sustained 2026 pivot toward retail BPO and outsourced customer-service helpdesks. The week's new CISA KEV additions land directly on retail-relevant infrastructure: Mirasvit Magento (CVE-2026-45247) hits direct-to-consumer storefronts, Chromium V8 (CVE-2026-11645) hits retail point-of-sale and back-office browsers, and the no-patch Cisco SD-WAN Manager (CVE-2026-20245) and Arista EOS (CVE-2026-7473) defects hit retail data-centre fabrics.

Key Judgements

The following key judgements represent the lead analyst’s assessed view at the time of issue. Each is qualified by an analytic confidence rating in line with the conventions described in Section 11.

1. It is highly likely that the Scattered Spider / DragonForce affiliate cluster will continue to define the dominant ransomware threat picture for UK retail through the next reporting cycle, with banking BPO and outsourced retail helpdesks as the principal target set. (HIGH confidence)
2. It is highly likely that retail storefronts running Mirasvit Full Page Cache Warmer for Magento will see opportunistic mass-scanning against CVE-2026-45247 within the next reporting cycle. (HIGH confidence)
3. It is likely that Qilin, TheGentlemen and Akira will produce at least one publicly-disclosed UK retail leak-site posting within the next two cycles, with MEDIUM-HIGH confidence given the May 2026 volume and UK national positioning. (MEDIUM-HIGH confidence)
4. It is highly likely that retail-sector loyalty-account credential-stuffing will continue to grow as a secondary fraud-adjacent threat, leveraging the same dark-market credential supply that powers M365 phishing campaigns. (HIGH confidence)
5. It is a realistic possibility that the no-patch Cisco SD-WAN Manager defect (CVE-2026-20245) will be exploited against a UK or EU retail data-centre estate within the next reporting cycle. (MEDIUM confidence)

2. Sector threat landscape

The retail vertical has not recovered from the operational and financial impact of the Scattered Spider / DragonForce campaign of April-May 2025. M&S estimated its incident at approximately GBP 300m, Co-op assessed revenue losses of approximately GBP 206m, and Harrods is the third confirmed major-retailer victim from the period. UK law enforcement arrested four individuals in July 2025 on suspicion of involvement, but the IAB front-end's operational capacity has not been materially degraded and 2026 reporting continues to attribute UK and EU retail intrusions to the same affiliate cluster.

Storefront and point-of-sale exposure dominates the week's new CVE picture. The Mirasvit Full Page Cache Warmer defect CVE-2026-45247 (KEV listed 03 June, deserialisation of untrusted data, CVSS 9.8) is acutely relevant to Magento retail estates running the Mirasvit extension. The Chromium V8 defect CVE-2026-11645 (KEV listed 09 June, OOB R/W, browser-side RCE) is relevant to retail back-office and point-of-sale browser estates running Chrome-derived browsers including Edge and Brave. Both warrant immediate vendor patching.

Edge-appliance and identity exposure continues to define the perimeter risk picture. The Cisco Catalyst SD-WAN Manager defect CVE-2026-20245 (no patch) and the Arista EOS tunnel-decap defect CVE-2026-7473 (no patch) are both relevant to retail data-centre fabrics. The Citrix NetScaler advisories from NCSC (CVE-2026-3055 / -4368) sit against the VPN concentrators used to reach retail back-office estates and store-level concentration points. The Fortinet FortiClient EMS pre-auth RCE (CVE-2026-35616) carries forward and is heavily used in retail multi-site deployments.

Ransomware and data-extortion volumes for the period remain at record levels. May 2026 placed Qilin at 97-101 victims, TheGentlemen at 70, Akira at 64 and DragonForce at 32; trailing-thirty-day exfiltration is approximately 115 TB across all groups. Retail and consumer-services entities continue to feature heavily in leak-site postings, with both customer PII and back-office data appearing as extortion levers.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the named vertical during the reporting period. The profile block below should be repeated, in full, for each actor profiled. Prioritise actors for whom new or sector-relevant activity has been observed within the reporting period; established actors with no recent activity may be referenced briefly without a full profile.

Scattered Spider / DragonForce affiliate cluster

• Aliases: UNC3944, Octo Tempest, Muddled Libra, 0ktapus, Scatter Swine
• Suspected Origin: UK / US / English-speaking community
• Suspected Sponsor: Criminal (IAB into DragonForce / LockBit / Qilin)
• Primary Motivation: Financial - extortion via partner ransomware
• Sector Targeting: Retail and consumer-services primary; Scattered Spider IAB front-end into DragonForce, LockBit and Qilin.
• Geographic Focus: UK, US, increasing EU and outsourced helpdesks abroad
• Signature TTPs: Voice-phishing of IT helpdesks, SIM-swap, MFA fatigue, OAuth consent-phish, RMM abuse (AnyDesk / ScreenConnect)
• Tooling / Malware Families: DragonForce / LockBit / Qilin partner encryptors; ESXi mass-encryption
• Recent Activity: DragonForce 32 victims in May 2026 (down from 41 in April per BreachSense); BPO / outsourced-helpdesk pattern continues.
• Assessed Threat to Vertical: HIGH - Admiralty A2.
• Analytic Confidence: HIGH - NCSC-UK, Sophos X-Ops, CrowdStrike, Mandiant multi-sourced

Qilin (a.k.a. Agenda, Qilin.B)

• Aliases: Agenda, Qilin.B
• Suspected Origin: Russia (Russian-speaking)
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - extortion / data theft
• Sector Targeting: Cross-sector with sustained Retail-sector relevance.
• Geographic Focus: Global; UK, EU, US, ANZ
• Signature TTPs: VPN-credential initial access via IABs; rapid DCSync; ESXi-aware encryptor; double-extortion with leak-site countdown
• Tooling / Malware Families: Qilin.B encryptor (Rust/Go), SystemBC, AnyDesk, Cobalt Strike, mimikatz, rclone
• Recent Activity: 97-101 victims posted in May 2026 - fifth consecutive month at top of leak-site postings (BreachSense / Check Point).
• Assessed Threat to Vertical: HIGH - Admiralty B2.
• Analytic Confidence: HIGH - multiply sourced (Check Point Research, BreachSense, Ransomware.live)

TheGentlemen

• Aliases: -
• Suspected Origin: Unattributed (likely Russian-speaking)
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - extortion
• Sector Targeting: Cross-sector with documented Retail-sector targeting.
• Geographic Focus: Cross-sector, global
• Signature TTPs: Rapid affiliate onboarding; multi-platform encryptor (Windows / Linux / BSD / NAS); SystemBC C2
• Tooling / Malware Families: Go-based encryptor; SystemBC; partner-supplied IAB access
• Recent Activity: 70 victims posted in May 2026 - second only to Qilin (BreachSense).
• Assessed Threat to Vertical: HIGH - Admiralty B2.
• Analytic Confidence: MEDIUM-HIGH

Akira

• Aliases: Akira / Megazord
• Suspected Origin: Russia-linked
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - extortion / data theft
• Sector Targeting: Cross-sector with sustained Retail-sector targeting via Cisco VPN credential abuse.
• Geographic Focus: Global
• Signature TTPs: Cisco VPN credential abuse (no-MFA accounts); Rust / C++ encryptor; ESXi targeting; data-extortion sites
• Tooling / Malware Families: Akira encryptor; LOLBin chain; AnyDesk; rclone
• Recent Activity: 64 victims posted in May 2026 - third in the leak-site ranking (BreachSense).
• Assessed Threat to Vertical: HIGH - Admiralty B2.
• Analytic Confidence: HIGH

[Repeat the profile block above for each additional threat actor. A typical monthly report will profile between two and four actors in detail; quarterly reports may profile more.]

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period. The corresponding behaviours should be cross-referenced to the incidents listed in Section 5 and to detection logic deployed within client environments.

5. Notable incidents and campaigns

Where peer organisations are named, the source of attribution is recorded. Where peer organisations are anonymised, the description is sufficient to convey the operational lessons without identifying the affected party.

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of affected products in the sector, and listing on the CISA Known Exploited Vulnerabilities catalogue. The remediation guidance should be read alongside the recommended actions in Section 9.

7. Indicators of compromise

The following indicators are provided to support detection engineering and threat hunting within client environments. Indicators are defanged in line with industry convention, and confidence ratings reflect the analyst’s assessment of the strength of the association between the indicator and the named actor or campaign. Indicators should be ingested with appropriate decay periods; high-confidence atomic indicators (hashes) generally warrant longer retention than network indicators (IPs, domains).

A machine-readable companion file in STIX 2.1 format is available on request from the lead analyst.

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical. The composite rating is intended to inform prioritisation of defensive investment and is not a substitute for an organisation-specific risk assessment.

9. Recommended defensive actions

The recommendations below are organised against the three operational pillars of Detect, Defend, and Disrupt. They are intended to be actionable within a typical client environment and should be prioritised according to the risk ratings assigned in Section 8 and the operational maturity of the receiving organisation.

Detect

Detection engineering should prioritise (a) Mirasvit / Magento Full Page Cache Warmer admin-endpoint anomalies and unauthenticated deserialisation patterns; (b) Cisco SD-WAN Manager netadmin and config-push events; (c) Arista EOS decap-protocol-conflation; (d) NetScaler tampering and session-token reuse; (e) OAuth consent-grant anomalies against M365 retail tenants; (f) Scattered-Spider-pattern helpdesk-reset call audit logs and AnyDesk / ScreenConnect installs; (g) loyalty-account credential-stuffing patterns across e-commerce front-ends.

Defend

Preventive priorities follow Section 6: enforce mitigation-only postures for CVE-2026-20245 and CVE-2026-7473; patch FortiClient EMS to 7.4.2; apply Citrix NetScaler firmware; patch Mirasvit extension on any Magento storefront and rotate any captured admin tokens; force Chromium update for CVE-2026-11645; force Defender MoCAMP roll-up. Enforce step-up authentication and call-back verification for all helpdesk password / MFA resets in line with NCSC's Scattered Spider guidance. Verify immutable backup posture for POS / merchandising / e-commerce hypervisor estates.

Disrupt

Disruption activity within client lawful authority should focus on: (i) coordinated sharing through the Retail and Hospitality ISAC of Scattered-Spider-themed helpdesk-phish indicators; (ii) takedown of attacker-controlled rclone / MEGA / AzCopy egress destinations; (iii) deception deployment on Mirasvit / Magento-themed honeypot domains; (iv) gift-card / loyalty-credential abuse-pattern sharing with affinity programmes and payment processors.

10. Forward outlook

Looking forward to the next reporting period (13-19 Jun 2026), it is highly likely that Scattered Spider / DragonForce activity against UK and EU retail will continue at the current operational tempo; it is likely that at least one UK retailer will publicly disclose a Magento or storefront-related incident traceable to CVE-2026-45247. Qilin and TheGentlemen are highly likely to retain leak-site dominance with retail entities continuing to appear.

Trigger conditions that would prompt revision of this outlook include: (a) public disclosure by a UK Tier-1 retailer of an incident traceable to one of the flagged CVEs; (b) appearance of a Scattered-Spider-attributed leak-site post naming a UK retailer; (c) RH-ISAC TLP:CLEAR notification of a sector-wide gift-card or loyalty-credential campaign; (d) NCSC follow-up advisory escalation. The principal intelligence gap is direct visibility into RH-ISAC TLP:CLEAR traffic for the 06-12 Jun period.

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst’s assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence drawn from multiple credible sources and a strong analytic line of reasoning; MEDIUM indicates plausibility supported by partial corroboration or sound analytic inference; LOW indicates limited evidence, single-sourcing, or significant uncertainty in the underlying data. Where confidence is LOW, the rationale is recorded in the body of the report rather than allowed to stand unexamined.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for reference.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System.

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.