A new and concerning threat actor has recently emerged, utilizing SQL injection attacks to gain unauthorized access to organizations operating in the APAC region. This article aims to provide a comprehensive overview of their activities, including the targeted websites, successful infiltrations, tools employed, language-based commands, remote file loading techniques, hosting with Supershell, modifications with Cobalt Strike, IP addresses used, and the availability of a detailed report on the threat actor’s activities.
Targeted Websites
The threat actor has brazenly targeted more than 20 websites across various sectors, encompassing government, gambling, retail, and travel sites. These attacks have reverberated across an array of countries, including Australia, China, Indonesia, the Philippines, India, South Korea, Thailand, and Brazil. This wide scope underscores the threat actor’s determination.
Successful Infiltration
Among the targeted websites, six organizations fell victim to the threat actor’s legacy SQL injection attacks, further highlighting the severity of this incursion. Their successful infiltration demonstrates the sophistication and persistence of this threat actor, necessitating a robust response from affected organizations and cybersecurity authorities.
In their nefarious activities, the threat actor leveraged a range of tools to exploit vulnerabilities in the targeted website’s security systems. Notably, they employed dirsearch, sqlmap, tinyproxy, redis-rogue-getshell, and CobaltStrike. These tools served as indispensable components of their attack arsenal, enabling them to navigate and exploit the compromised systems.
An intriguing aspect of the threat actor’s tactics lies in their frequent utilization of language-based ‘export’ commands. Out of the 750 commands executed on each server, an astonishing 95 of these were comprised of ‘export’ commands. This suggests a specific modus operandi designed to optimize their infiltration techniques or indicates a unique approach tailored to specific vulnerabilities.
Remote File Loading
To facilitate their actions, the threat actor ingeniously employed a ‘wget’ command, allowing them to load files from remote sources. This technique not only masks their activities but also enables the introduction of malicious files, further exacerbating the threat posed to infiltrated organizations.
Hosting with Supershell
The remote server utilized by the threat actor was found to be hosted on Supershell, a Chinese-language framework equipped with a user interface specifically designed for creating and managing reverse shells. This discovery sheds light on the potential origins or affiliations of the threat actor, further enhancing the urgency to curtail their malicious activities.
Modifications with Cobalt Strike
Cobalt Strike, a popular and versatile penetration testing tool, was manipulated by the threat actors to suit their objectives. Several modifications were made to launch their profiles with the C2 domains. These adaptations showcase their technical proficiency and adaptability, requiring defenders to stay vigilant and remain updated.
IP addresses and Operator Panel Access
During the investigation, several IP addresses were identified, revealing the threat actor’s logins into the operator panel. These IP addresses present potential leads for authorities to investigate their origin or trace possible connections to other cybercriminal networks.
In recognition of the significant threat posed by this newly discovered threat actor, a detailed report has been published. This comprehensive document provides invaluable insights into the GambleForce threat actor, shedding light on their attack methods, command executions, utilization of the MITRE Framework, and a range of other pertinent details. Armed with this information, organizations and cybersecurity experts can fortify their defenses, identify potential vulnerabilities, and thwart future attacks orchestrated by the GambleForce threat actor.
In conclusion, the emergence of a new threat actor leveraging SQL injection attacks in the APAC region demands immediate attention. By comprehensively understanding their tactics, tools, and infiltration techniques, organizations can proactively shield themselves against this growing menace. Collaboration and information sharing are imperative in combating cyber threats, ensuring a safer digital landscape for all.