GambleForceThreat actor
GambleForce is a threat actor specializing in SQL injection attacks. They have targeted over 20 websites in various sectors across multiple countries, compromising six companies. GambleForce utilizes publicly available pentesting tools and has been active since mid-September 2023.From MISP Galaxy
Last reported 2 years ago, by Group-IB2 reports
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: PowerShell: T1059.001”
- T1059.001PowerShell
“Command and Scripting Interpreter: PowerShell: T1059.001”
- T1189Drive-by Compromise
“Drive-by Compromise: T1189”
- T1190Exploit Public-Facing Application
“Exploit Public-Facing Application: T1190”
- T1583.001Domains
“Domains: T1583.001”
- T1583.004Server
“Server: T1583.004”
What the reports say
2 reports, newest first · the exact sentence from each-
Dead-end job: ResumeLooters infect websites in APAC through SQL injection and XSS attacks“In December 2023, Group-IB published a report about GambleForce – an SQL injection gang that has carried out over 20 attacks against websites in the region.”
-
Ace in the Hole: exposing GambleForce, an SQL injection gang“Ace in the Hole: exposing GambleForce, an SQL injection gang”
Indicators in its reports
named in the reports above- window.location[.]hostin 1 report
- 8r[.]aein 1 report
- hxxps://jobsin 1 report
- jobsin 1 report
- admin.cloudnetsafe[.]comin 1 report
- hxxp://139.84.130[.]232:8080/CcrN3QqWOeRx/KAGctYUciin 1 report
- 139.84.130[.]232in 1 report
- hxxp://139.84.130[.]232:8080/CcrN3QqWOeRx/iDDHJOuzw/1in 1 report
- hxxp://139.84.130[.]232:8080/CcrN3QqWOeRxin 1 report
- hxxp://admin.cloudnetsofe[.]com/in 1 report
- admin.cloudnetsofe[.]comin 1 report
- hxxps://www.google[.]com/recaptcha/api.js?hl=vi%E2%80%9Din 1 report
- hxxps://sb8[.]co/online.htm%E2%80%99;document.body.appendChildin 1 report
- sb8[.]coin 1 report
- hxxps://139.84.168[.]189:3000/jquery.js%E2%80%99;document.body.appendChildin 1 report
- 139.84.168[.]189in 1 report
- hxxps://admin.cloudnetsofe[.]com/if.js%E2%80%99;document.body.appendChildin 1 report
- hxxps://sb8[.]co/online.htmin 1 report
- hxxps://api.qu3[.]cc/?js=sb8.co%E2%80%9Din 1 report
- api.qu3[.]ccin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.