New Threat Actor Targets APAC Organizations Using SQL Injection Attacks

A new and concerning threat actor has recently emerged, utilizing SQL injection attacks to gain unauthorized access to organizations operating in the APAC region. This article aims to provide a comprehensive overview of their activities, including the targeted websites, successful infiltrations, tools employed, language-based commands, remote file loading techniques, hosting with Supershell, modifications with Cobalt Strike, IP addresses used, and the availability of a detailed report on the threat actor’s activities.

Targeted Websites

The threat actor has brazenly targeted more than 20 websites across various sectors, encompassing government, gambling, retail, and travel sites. These attacks have reverberated across an array of countries, including Australia, China, Indonesia, the Philippines, India, South Korea, Thailand, and Brazil. This wide scope underscores the threat actor’s determination.

Successful Infiltration

Among the targeted websites, six organizations fell victim to the threat actor’s legacy SQL injection attacks, further highlighting the severity of this incursion. Their successful infiltration demonstrates the sophistication and persistence of this threat actor, necessitating a robust response from affected organizations and cybersecurity authorities.

In their nefarious activities, the threat actor leveraged a range of tools to exploit vulnerabilities in the targeted website’s security systems. Notably, they employed dirsearch, sqlmap, tinyproxy, redis-rogue-getshell, and CobaltStrike. These tools served as indispensable components of their attack arsenal, enabling them to navigate and exploit the compromised systems.

An intriguing aspect of the threat actor’s tactics lies in their frequent utilization of language-based ‘export’ commands. Out of the 750 commands executed on each server, an astonishing 95 of these were comprised of ‘export’ commands. This suggests a specific modus operandi designed to optimize their infiltration techniques or indicates a unique approach tailored to specific vulnerabilities.

Remote File Loading

To facilitate their actions, the threat actor ingeniously employed a ‘wget’ command, allowing them to load files from remote sources. This technique not only masks their activities but also enables the introduction of malicious files, further exacerbating the threat posed to infiltrated organizations.

Hosting with Supershell

The remote server utilized by the threat actor was found to be hosted on Supershell, a Chinese-language framework equipped with a user interface specifically designed for creating and managing reverse shells. This discovery sheds light on the potential origins or affiliations of the threat actor, further enhancing the urgency to curtail their malicious activities.

Modifications with Cobalt Strike

Cobalt Strike, a popular and versatile penetration testing tool, was manipulated by the threat actors to suit their objectives. Several modifications were made to launch their profiles with the C2 domains. These adaptations showcase their technical proficiency and adaptability, requiring defenders to stay vigilant and remain updated.

IP addresses and Operator Panel Access

During the investigation, several IP addresses were identified, revealing the threat actor’s logins into the operator panel. These IP addresses present potential leads for authorities to investigate their origin or trace possible connections to other cybercriminal networks.

In recognition of the significant threat posed by this newly discovered threat actor, a detailed report has been published. This comprehensive document provides invaluable insights into the GambleForce threat actor, shedding light on their attack methods, command executions, utilization of the MITRE Framework, and a range of other pertinent details. Armed with this information, organizations and cybersecurity experts can fortify their defenses, identify potential vulnerabilities, and thwart future attacks orchestrated by the GambleForce threat actor.

In conclusion, the emergence of a new threat actor leveraging SQL injection attacks in the APAC region demands immediate attention. By comprehensively understanding their tactics, tools, and infiltration techniques, organizations can proactively shield themselves against this growing menace. Collaboration and information sharing are imperative in combating cyber threats, ensuring a safer digital landscape for all.

Explore more

How Can We Boost Engagement in a Burnout-Prone Workforce?

Walk into a typical office in 2025, and the atmosphere often feels heavy with unspoken exhaustion—employees dragging through the day with forced smiles, their energy sapped by endless demands, reflecting a deeper crisis gripping workforces worldwide. Burnout has become a silent epidemic, draining passion and purpose from millions. Yet, amid this struggle, a critical question emerges: how can engagement be

Leading HR with AI: Balancing Tech and Ethics in Hiring

In a bustling hotel chain, an HR manager sifts through hundreds of applications for a front-desk role, relying on an AI tool to narrow down the pool in mere minutes—a task that once took days. Yet, hidden in the algorithm’s efficiency lies a troubling possibility: what if the system silently favors candidates based on biased data, sidelining diverse talent crucial

Will AI Replace Human HR in Tech Recruitment?

In a bustling tech hub, a hiring manager at a leading software firm watches as an AI system screens 10,000 applications in mere hours, shortlisting candidates for a critical cybersecurity role, transforming a process that once took weeks into one that unfolds before lunch. Yet, as the algorithm delivers its top picks, a nagging doubt lingers—can a machine truly grasp

How Are Data Engineering and AI Transforming Private Equity?

What happens when an industry built on gut instinct and boardroom strategy collides with the raw power of data and artificial intelligence? Private equity, long a domain of high-stakes financial maneuvering, is undergoing a radical shift as technology rewrites the rules of the game. Picture a deal room where algorithms uncover hidden risks in seconds, or a portfolio dashboard predicting

Boost Small Business Growth with Buy Now, Pay Later Tools

In the bustling world of retail, small businesses are constantly searching for innovative ways to stand out and attract customers, and one powerful solution is making waves in 2025. Picture a young shopper eyeing a coveted gadget in a local store, hesitating at the price tag—until they spot a sign offering payment in easy, interest-free installments. This is the power