New Hacker Group ‘GambleForce’ Tageting APAC Firms Using SQL Injection Attacks

A earlier unfamiliar hacker outfit known as GambleForce has been attributed to a collection of SQL injection attacks against companies generally in the Asia-Pacific (APAC) region because at least September 2023.

“GambleForce employs a established of standard still incredibly productive approaches, which includes SQL injections and the exploitation of susceptible web-site articles administration methods (CMS) to steal delicate details, this sort of as user qualifications,” Singapore-headquartered Group-IB said in a report shared with The Hacker News.

The team is approximated to have qualified 24 companies in the gambling, govt, retail, and vacation sectors across Australia, Brazil, China, India, Indonesia, the Philippines, South Korea, and Thailand. 6 of these attacks ended up profitable.

Forthcoming WEBINAR Conquer AI-Run Threats with Zero Belief – Webinar for Security Professionals

Standard security measures will not lower it in today’s earth. It’s time for Zero Rely on Security. Secure your information like never prior to.

Be a part of Now

The modus operandi of GambleForce is its special reliance on open up-supply tools like dirsearch, sqlmap, tinyproxy, and redis-rogue-getshell at different stages of the assaults with the top goal of exfiltrating delicate details from compromised networks.

Also used by the threat actor is the respectable post-exploitation framework recognised as Cobalt Strike. Interestingly, the variation of the device identified on its attack infrastructure applied commands in Chinese, even though the group’s origins are significantly from crystal clear.

The attack chains entail the abuse of victims’ public-experiencing programs of victims by exploiting SQL injections as effectively as the exploitation of CVE-2023-23752, a medium-severity flaw in Joomla CMS, to achieve unauthorized accessibility to a Brazilian firm.

It is at present not acknowledged how GambleForce leverages the stolen facts. The cybersecurity agency said it also took down the adversary’s command-and-manage (C2) server and notified the identified victims.

“Web injections are among the oldest and most common attack vectors,” Nikita Rostovcev, senior threat analyst at Team-IB, explained.

“And the rationale currently being is that from time to time builders forget the importance of enter security and information validation. Insecure coding procedures, incorrect databases settings, and out-of-date software generate a fertile environment for SQL injection assaults on web applications.”

Found this write-up exciting? Follow us on Twitter  and LinkedIn to read far more unique written content we write-up.

Some parts of this article are sourced from:
thehackernews.com