New Threat Actor Targets APAC Organizations Using SQL Injection Attacks

A new and concerning threat actor has recently emerged, utilizing SQL injection attacks to gain unauthorized access to organizations operating in the APAC region. This article aims to provide a comprehensive overview of their activities, including the targeted websites, successful infiltrations, tools employed, language-based commands, remote file loading techniques, hosting with Supershell, modifications with Cobalt Strike, IP addresses used, and the availability of a detailed report on the threat actor’s activities.

Targeted Websites

The threat actor has brazenly targeted more than 20 websites across various sectors, encompassing government, gambling, retail, and travel sites. These attacks have reverberated across an array of countries, including Australia, China, Indonesia, the Philippines, India, South Korea, Thailand, and Brazil. This wide scope underscores the threat actor’s determination.

Successful Infiltration

Among the targeted websites, six organizations fell victim to the threat actor’s legacy SQL injection attacks, further highlighting the severity of this incursion. Their successful infiltration demonstrates the sophistication and persistence of this threat actor, necessitating a robust response from affected organizations and cybersecurity authorities.

In their nefarious activities, the threat actor leveraged a range of tools to exploit vulnerabilities in the targeted website’s security systems. Notably, they employed dirsearch, sqlmap, tinyproxy, redis-rogue-getshell, and CobaltStrike. These tools served as indispensable components of their attack arsenal, enabling them to navigate and exploit the compromised systems.

An intriguing aspect of the threat actor’s tactics lies in their frequent utilization of language-based ‘export’ commands. Out of the 750 commands executed on each server, an astonishing 95 of these were comprised of ‘export’ commands. This suggests a specific modus operandi designed to optimize their infiltration techniques or indicates a unique approach tailored to specific vulnerabilities.

Remote File Loading

To facilitate their actions, the threat actor ingeniously employed a ‘wget’ command, allowing them to load files from remote sources. This technique not only masks their activities but also enables the introduction of malicious files, further exacerbating the threat posed to infiltrated organizations.

Hosting with Supershell

The remote server utilized by the threat actor was found to be hosted on Supershell, a Chinese-language framework equipped with a user interface specifically designed for creating and managing reverse shells. This discovery sheds light on the potential origins or affiliations of the threat actor, further enhancing the urgency to curtail their malicious activities.

Modifications with Cobalt Strike

Cobalt Strike, a popular and versatile penetration testing tool, was manipulated by the threat actors to suit their objectives. Several modifications were made to launch their profiles with the C2 domains. These adaptations showcase their technical proficiency and adaptability, requiring defenders to stay vigilant and remain updated.

IP addresses and Operator Panel Access

During the investigation, several IP addresses were identified, revealing the threat actor’s logins into the operator panel. These IP addresses present potential leads for authorities to investigate their origin or trace possible connections to other cybercriminal networks.

In recognition of the significant threat posed by this newly discovered threat actor, a detailed report has been published. This comprehensive document provides invaluable insights into the GambleForce threat actor, shedding light on their attack methods, command executions, utilization of the MITRE Framework, and a range of other pertinent details. Armed with this information, organizations and cybersecurity experts can fortify their defenses, identify potential vulnerabilities, and thwart future attacks orchestrated by the GambleForce threat actor.

In conclusion, the emergence of a new threat actor leveraging SQL injection attacks in the APAC region demands immediate attention. By comprehensively understanding their tactics, tools, and infiltration techniques, organizations can proactively shield themselves against this growing menace. Collaboration and information sharing are imperative in combating cyber threats, ensuring a safer digital landscape for all.

Explore more

Why is LinkedIn the Go-To for B2B Advertising Success?

In an era where digital advertising is fiercely competitive, LinkedIn emerges as a leading platform for B2B marketing success due to its expansive user base and unparalleled targeting capabilities. With over a billion users, LinkedIn provides marketers with a unique avenue to reach decision-makers and generate high-quality leads. The platform allows for strategic communication with key industry figures, a crucial

Endpoint Threat Protection Market Set for Strong Growth by 2034

As cyber threats proliferate at an unprecedented pace, the Endpoint Threat Protection market emerges as a pivotal component in the global cybersecurity fortress. By the close of 2034, experts forecast a monumental rise in the market’s valuation to approximately US$ 38 billion, up from an estimated US$ 17.42 billion. This analysis illuminates the underlying forces propelling this growth, evaluates economic

How Will ICP’s Solana Integration Transform DeFi and Web3?

The collaboration between the Internet Computer Protocol (ICP) and Solana is poised to redefine the landscape of decentralized finance (DeFi) and Web3. Announced by the DFINITY Foundation, this integration marks a pivotal step in advancing cross-chain interoperability. It follows the footsteps of previous successful integrations with Bitcoin and Ethereum, setting new standards in transactional speed, security, and user experience. Through

Embedded Finance Ecosystem – A Review

In the dynamic landscape of fintech, a remarkable shift is underway. Embedded finance is taking the stage as a transformative force, marking a significant departure from traditional financial paradigms. This evolution allows financial services such as payments, credit, and insurance to seamlessly integrate into non-financial platforms, unlocking new avenues for service delivery and consumer interaction. This review delves into the

Certificial Launches Innovative Vendor Management Program

In an era where real-time data is paramount, Certificial has unveiled its groundbreaking Vendor Management Partner Program. This initiative seeks to transform the cumbersome and often error-prone process of insurance data sharing and verification. As a leader in the Certificate of Insurance (COI) arena, Certificial’s Smart COI Network™ has become a pivotal tool for industries relying on timely insurance verification.