ResumeLootersThreat actor
Since the beginning of 2023, ResumeLooters have been able to compromise at least 65 websites. The group employs a variety of simple techniques, including SQL injection and XSS. The threat actor attempted to insert XSS scripts into all available forms, aiming to execute it on the administrators’ device to obtain admin credentials.From MISP Galaxy
Last reported 2 years ago, by Group-IB2 reports
ATT&CK techniques
6 of 9 · each with the sentence it comes from- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: PowerShell: T1059.001”
- T1059.001PowerShell
“Command and Scripting Interpreter: PowerShell: T1059.001”
- T1189Drive-by Compromise
“Drive-by Compromise: T1189”
- T1190Exploit Public-Facing Application
“Exploit Public-Facing Application: T1190”
- T1583.001Domains
“Domains: T1583.001”
- T1583.004Server
“Server: T1583.004”
What the reports say
2 reports, newest first · the exact sentence from each-
Concealed networks: Are dark web syndicates turning to social media for cybercrime?“ResumeLooters Attack”
-
Dead-end job: ResumeLooters infect websites in APAC through SQL injection and XSS attacks“Dead-end job: ResumeLooters infect websites in APAC through SQL injection and XSS attacks”
Indicators in its reports
named in the reports above- window.location[.]hostin 1 report
- breachforums[.]isin 1 report
- 8r[.]aein 1 report
- hxxps://jobsin 1 report
- jobsin 1 report
- admin.cloudnetsafe[.]comin 1 report
- hxxp://139.84.130[.]232:8080/CcrN3QqWOeRx/KAGctYUciin 1 report
- 139.84.130[.]232in 1 report
- hxxp://139.84.130[.]232:8080/CcrN3QqWOeRx/iDDHJOuzw/1in 1 report
- hxxp://139.84.130[.]232:8080/CcrN3QqWOeRxin 1 report
- hxxp://admin.cloudnetsofe[.]com/in 1 report
- admin.cloudnetsofe[.]comin 1 report
- hxxps://www.google[.]com/recaptcha/api.js?hl=vi%E2%80%9Din 1 report
- hxxps://sb8[.]co/online.htm%E2%80%99;document.body.appendChildin 1 report
- sb8[.]coin 1 report
- hxxps://139.84.168[.]189:3000/jquery.js%E2%80%99;document.body.appendChildin 1 report
- 139.84.168[.]189in 1 report
- hxxps://admin.cloudnetsofe[.]com/if.js%E2%80%99;document.body.appendChildin 1 report
- hxxps://sb8[.]co/online.htmin 1 report
- hxxps://api.qu3[.]cc/?js=sb8.co%E2%80%9Din 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.