New Threat Actor Targets APAC Organizations Using SQL Injection Attacks

A new and concerning threat actor has recently emerged, utilizing SQL injection attacks to gain unauthorized access to organizations operating in the APAC region. This article aims to provide a comprehensive overview of their activities, including the targeted websites, successful infiltrations, tools employed, language-based commands, remote file loading techniques, hosting with Supershell, modifications with Cobalt Strike, IP addresses used, and the availability of a detailed report on the threat actor’s activities.

Targeted Websites

The threat actor has brazenly targeted more than 20 websites across various sectors, encompassing government, gambling, retail, and travel sites. These attacks have reverberated across an array of countries, including Australia, China, Indonesia, the Philippines, India, South Korea, Thailand, and Brazil. This wide scope underscores the threat actor’s determination.

Successful Infiltration

Among the targeted websites, six organizations fell victim to the threat actor’s legacy SQL injection attacks, further highlighting the severity of this incursion. Their successful infiltration demonstrates the sophistication and persistence of this threat actor, necessitating a robust response from affected organizations and cybersecurity authorities.

In their nefarious activities, the threat actor leveraged a range of tools to exploit vulnerabilities in the targeted website’s security systems. Notably, they employed dirsearch, sqlmap, tinyproxy, redis-rogue-getshell, and CobaltStrike. These tools served as indispensable components of their attack arsenal, enabling them to navigate and exploit the compromised systems.

An intriguing aspect of the threat actor’s tactics lies in their frequent utilization of language-based ‘export’ commands. Out of the 750 commands executed on each server, an astonishing 95 of these were comprised of ‘export’ commands. This suggests a specific modus operandi designed to optimize their infiltration techniques or indicates a unique approach tailored to specific vulnerabilities.

Remote File Loading

To facilitate their actions, the threat actor ingeniously employed a ‘wget’ command, allowing them to load files from remote sources. This technique not only masks their activities but also enables the introduction of malicious files, further exacerbating the threat posed to infiltrated organizations.

Hosting with Supershell

The remote server utilized by the threat actor was found to be hosted on Supershell, a Chinese-language framework equipped with a user interface specifically designed for creating and managing reverse shells. This discovery sheds light on the potential origins or affiliations of the threat actor, further enhancing the urgency to curtail their malicious activities.

Modifications with Cobalt Strike

Cobalt Strike, a popular and versatile penetration testing tool, was manipulated by the threat actors to suit their objectives. Several modifications were made to launch their profiles with the C2 domains. These adaptations showcase their technical proficiency and adaptability, requiring defenders to stay vigilant and remain updated.

IP addresses and Operator Panel Access

During the investigation, several IP addresses were identified, revealing the threat actor’s logins into the operator panel. These IP addresses present potential leads for authorities to investigate their origin or trace possible connections to other cybercriminal networks.

In recognition of the significant threat posed by this newly discovered threat actor, a detailed report has been published. This comprehensive document provides invaluable insights into the GambleForce threat actor, shedding light on their attack methods, command executions, utilization of the MITRE Framework, and a range of other pertinent details. Armed with this information, organizations and cybersecurity experts can fortify their defenses, identify potential vulnerabilities, and thwart future attacks orchestrated by the GambleForce threat actor.

In conclusion, the emergence of a new threat actor leveraging SQL injection attacks in the APAC region demands immediate attention. By comprehensively understanding their tactics, tools, and infiltration techniques, organizations can proactively shield themselves against this growing menace. Collaboration and information sharing are imperative in combating cyber threats, ensuring a safer digital landscape for all.

Explore more

Why Do Talent Management Strategies Fail and How to Fix Them?

What happens when the systems meant to reward talent and dedication instead deepen unfairness in the workplace? Across industries, countless organizations invest heavily in talent management strategies, aiming to build a merit-based culture where the best rise to the top. Yet, far too often, these efforts falter, leaving employees disillusioned and companies grappling with inequity and inefficiency. This pervasive issue

Mastering Digital Marketing for NGOs in 2025: A Guide

In a world where over 5 billion people are online daily, NGOs face an unprecedented opportunity to amplify their missions through digital channels, yet the challenge of cutting through the noise has never been greater. Imagine an organization like Dianova International, working across 17 countries on critical issues like health, education, and gender equality, struggling to reach the right audience

How Can Leaders Prepare for the Cognitive Revolution?

Embracing the Intelligence Age: Why Leaders Must Act Now Imagine a world where machines not only perform tasks but also think, learn, and adapt alongside human workers, transforming every industry from manufacturing to healthcare in ways we are only beginning to comprehend. This is not a distant dream but the reality of the cognitive industrial revolution, often referred to as

Why Do Leaders Lack Empathy During Layoffs? New Survey Shows

Introduction In the current business landscape, layoffs have become a stark reality, cutting across industries from technology to retail, with countless employees facing the uncertainty of job loss. A staggering 53% of workers globally express fear of being laid off within the next year, reflecting a pervasive anxiety that shapes workplace dynamics and underscores a critical challenge for leaders. How

Employee Engagement Crisis: How to Restore Workplace Happiness

We’re thrilled to sit down with Ling-Yi Tsai, a renowned HRTech expert with decades of experience helping organizations navigate change through innovative technology. With a deep focus on HR analytics and the seamless integration of tech in recruitment, onboarding, and talent management, Ling-Yi offers invaluable insights into the pressing challenges of employee engagement and workplace well-being. In this conversation, we