From gambling to government websites, the Asia-Pacific region is under attack by a new threat actor known as GambleForce. This cybercriminal group has been spotted targeting a wide range of entities in sectors such as government, gambling, retail, travel, and job seeking, with the primary objective of stealing sensitive data. In this article, we delve into the actions taken by cybersecurity analyst Group-IB to halt GambleForce’s operations, their attack techniques, the scope of their targets, tools and methods employed, data exfiltration attempts, motives behind their activities, and the expectation of their return.
Group-IB’s Action against the Gang
Working diligently to protect organizations from cyber threats, Group-IB has announced that they successfully disabled the command and control center of GambleForce. While this is a significant achievement, they expect the gang to regroup and resume their illicit activities in the future. Group-IB’s emergency response team has demonstrated their capability to disrupt cybercrime operations, but the gang may evolve their tactics and infrastructure to continue their campaign.
Attack Techniques Used
GambleForce utilizes a well-known and effective attack method called structured query language (SQL) injection. This approach involves manipulating a website’s vulnerable code to extract sensitive information from databases. Although SQL injection attacks have been around for some time, they persist due to their effectiveness. By exploiting weaknesses in a targeted website’s code, the gang gains unauthorized access to databases and exfiltrates valuable data.
Targets of the Gang
GambleForce has made its presence felt across the Asia-Pacific region, with approximately two dozen entities falling victim to their attacks. These entities span various sectors, including government, gambling, retail, travel, and jobseeking. The wide range of targets suggests that the gang is motivated by financial gain or may be collecting data for potential future use.
Tools and Methods Employed by the Gang
To carry out their SQL injection attacks, GambleForce relies on open-source digital tools such as Cobalt Strike. This software framework, while legitimate in its intended use, is often misused by threat actors for malicious purposes. Cobalt Strike provides a range of capabilities that enable the gang to infiltrate vulnerable websites and compromise databases. Prior to their server being disabled by Group-IB, GambleForce experienced a considerable level of success.
Data Exfiltration Attempts
Once inside the targeted databases, GambleForce attempts to extract any available pieces of valuable information. This includes retrieving hashed and plain-text user credentials, essentially compromising the integrity of the victims’ personal and sensitive data. By stealing login credentials, the gang may be able to gain unauthorized access to other online accounts or sell this information on the black market to other cybercriminals.
Uncertain Motivations and Uses of Stolen Data
While the gang’s tactics and targets are clear, their motivations and exact purposes for stealing data remain unknown. It is uncertain whether GambleForce plans to sell the stolen data, execute subsequent targeted attacks, or use it for other illicit activities. Understanding their ultimate goals is crucial for developing appropriate preventive measures and mitigating the potential impact on affected entities and individuals.
Expectation of the Gang’s Return
Despite Group-IB’s successful intervention, it is highly likely that GambleForce will soon resurface with new infrastructure and tactics. The gang has already been detected in an attack targeting a Brazilian entity, indicating their intent to expand their operations beyond the Asia-Pacific region. It is imperative for organizations, both within the targeted sectors and others, to remain vigilant and reinforce cybersecurity measures to defend against the imminent return of this cyber threat.
GambleForce poses a significant cyber threat to the Asia-Pacific region, utilizing SQL injection attacks to steal valuable data from various sectors. Group-IB’s commendable efforts in disabling the gang’s command and control center demonstrate the necessity of proactive cybersecurity measures employed by organizations and cybersecurity professionals. While the motivations and uses of the stolen data remain unclear, the potential harms of such breaches warrant heightened vigilance and continuous investment in adequate security measures. By staying proactive and adaptive, organizations can counter the evolving tactics of threat actors like GambleForce and protect the integrity and confidentiality of their data.