Threat actors evolved tactics, opting for a more nuanced approach that spread attacks across a broader timeframe to blend in with legitimate traffic and evade detection during peak holiday shopping times, according to Cequence Security.
2023 holiday season unveiled alarming realities
The months before the 2023 holidays demonstrated a change in tactics, techniques, and procedures by adversaries against prominent retailers. Attackers have shown that they are highly sophisticated and have great persistence and depth of planning.
“The 2023 holiday season exposed a chilling reality: cybercriminals are employing increasingly sophisticated attack methods and meticulously planning months to exploit vulnerabilities,” said William Glazier, Director of Threat Research at Cequence.
“This long-term approach allows them to target unprepared retailers and unsuspecting customers, particularly during peak shopping periods. This shift underscores the urgent need for heightened vigilance and proactive security measures throughout the year,” Glazier added.
Many companies, and retailers in particular, take the holiday season as their cue to focus more on security and begin to lock down their networks and applications. The data suggests that sophisticated attackers began their “attack runs” earlier in the year to lay the groundwork for holiday sales to try and avoid the retailers’ security lockdowns as much as possible.
In the second half of 2023 alone, gift card fraud increased by 110%, while scraping, loyalty card fraud and payment card fraud increased by a collective average of over 700% as attackers lay the groundwork for holiday sale attacks ahead of retailer security crackdowns.
These types of attacks are correlated and spiked together because those parts of the website, applications, and associated hackers employ nuanced tactics evade detection
