I am a cybersecurity pro and here’s the most powerful strategy criminals are using against retailers right now

The recent ransomware attack on Peter Green Chilled, a UK logistics provider responsible for refrigerated deliveries to major supermarkets, didn’t just delay shipments. It sent a warning shot to the entire retail industry. When chilled goods can’t reach stores, the consequences are immediate: shelves go empty, supply chains falter and customer trust erodes. This attack joins a string of recent incidents targeting retailers including Marks & Spencer, Co-op, Harrods, Adidas and Victoria’s Secret.

What’s happening isn’t random. Retail is being deliberately and strategically targeted by cybercriminal groups aiming to create high-impact disruption. These organizations are particularly vulnerable because they rely on just-in-time logistics, operate on thin margins and depend on a vast network of third-party vendors and suppliers. When one link in that chain breaks, the effects cascade, making retailers more likely to pay ransoms to get back online fast.

Scattered Spider and the Evolution of Social Engineering

Among the groups behind this wave of attacks is Scattered Spider, also known by its designation UNC3944, a highly sophisticated collective that has focused its efforts on enterprises in both the UK and the U.S.

Scattered Spider rose to notoriety through phishing and SIM-swapping campaigns, but it has since evolved into a much more formidable threat. Today, the group employs a blend of social engineering, credential harvesting and abuse of legitimate tools to infiltrate environments and evade detection.

Key to Scattered Spider’s effectiveness is its ability to impersonate internal support teams. By using tactics like help desk impersonation and SMS-based phishing, also known as smishing, they exploit trust relationships within an organization. Employees, particularly those in IT and administrative roles, become the primary targets. When these workers are convinced to reset MFA settings or hand over credentials, the attackers gain immediate, privileged access.

What sets Scattered Spider apart is its fluency in English, familiarity with Western business operations and ability to operate in real time. These are not language-barrier-limited, spray-and-pray operations. These are targeted intrusions executed with precision.

When Trusted Tools Become Threat Vectors

Perhaps most concerning is how attackers are co-opting the very tools defenders rely on. Remote administration utilities like AnyDesk, TeamViewer and Microsoft Quick Assist are frequently used by internal IT teams for legitimate support tasks. But in the hands of an adversary, they become stealthy weapons.

These tools don’t raise red flags in the same way malware might. They’re signed, trusted and often already whitelisted in security policies. That makes them perfect vehicles for attackers seeking to maintain persistence and move laterally inside networks.

Retail organizations, with dispersed physical locations and complex logistics ecosystems, are particularly reliant on remote access software. This reliance opens up a massive surface for abuse, especially when access permissions are overly broad or insufficiently monitored.

A Playbook for Retail Resilience

As threat actors increasingly exploit trusted tools and personnel, retailers must focus on reducing their attack surface and limiting the blast radius of potential breaches. This means going beyond reactive measures and embedding proactive security into everyday operations. Retailers can take action with strategies like these:

Harden Identity Controls: Organizations must implement strict policies for MFA and password resets. Real-time monitoring of these actions is essential to catch anomalies such as MFA enrollment from an unfamiliar device or rapid changes to high-privilege accounts.

Lock Down Remote Access: Remote access tools should be treated as sensitive assets. Their use must be tightly controlled, with policies in place to ensure they are only enabled when explicitly approved. Security teams should maintain inventories of authorized tools and actively hunt for unauthorized use.

Monitor for Behavioral Anomalies: Relying solely on signatures and known indicators of compromise is no longer sufficient. Security operations centers (SOCs) should implement behavioral analytics to identify unusual access patterns, like logins during off-hours, large data transfers from point-of-sale systems or unusual access from vendor accounts.

Prioritize Training for High-Risk Roles: Help desk workers, IT administrators and third-party vendors often have elevated access and are prime targets for social engineering. These employees must receive ongoing training not just on phishing, but on impersonation tactics, smishing attempts and unusual requests that should raise red flags.

Protecting Trust, Operations and the Bottom Line

The recent surge in retail-targeted ransomware attacks underscores a critical truth: security is no longer just a back-office function. It’s a frontline defense that directly affects customer experience, brand reputation and business continuity.

Retailers can no longer afford to take a reactive stance. The focus must shift toward continuous control validation, proactive threat hunting and investing in tools that reduce human error and shorten response times. That means combining technical controls with a strong culture of awareness, empowering employees to be an extension of the security team, not just a vulnerability.

The next ransomware attack won’t just compromise data. It could halt the movement of goods, empty shelves and leave customers questioning a brand’s reliability. For retailers, cybersecurity is now a matter of operational survival. And for groups like Scattered Spider, the attack surface has never been more inviting.

We list the best identity management software.

This article was produced as part of TechRadarPro’s Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro