Full Report
Analysis of TTPs tied to GambleForce, which carried out SQL injection attacks against companies in the APAC region
Analysis Summary
# Threat Actor: GambleForce
## Attribution & Identity
* **Actor Identification:** GambleForce is a sophisticated threat actor group primarily focused on data theft via SQL injection.
* **Aliases:** GambleForce.
* **Known Associations:** The group is noted for using common open-source penetration testing tools rather than custom-developed malware, which often aids in obscuring their specific identity.
## Activity Summary
GambleForce has been active since at least September 2023. The group has carried out a series of SQL injection attacks targeting organizations in the Asia-Pacific (APAC) region. Between September and December 2023, the group targeted at least 24 organizations across eight countries. Their primary objective appears to be the exfiltration of sensitive information, such as user credentials and personal data, from compromised databases.
## Tactics, Techniques & Procedures
GambleForce relies heavily on exploiting public-facing web vulnerabilities to gain initial access.
* **SQL Injection (SQLi):** The primary method for data exfiltration and bypassing authentication.
* **Exploitation of Public-Facing Applications:** Utilizing vulnerabilities in web applications to interact with backend databases. [T1190]
* **Automated Scanning/Tooling:** Use of malicious bots to systematically identify and exploit vulnerable systems.
* **Data from Information Repositories:** Accessing and exfiltrating sensitive database contents. [T1213]
## Targeting
* **Sectors:** Gambling/Gaming, Government, Retail, Travel, and Education.
* **Geography:** Primarily the APAC region, including:
* Australia
* China
* Indonesia
* Philippines
* South Korea
* Thailand
* Vietnam
* **Victims:** At least 24 organizations were identified as victims in the late 2023 campaign.
## Tools & Infrastructure
* **Tools:**
* **sqlmap:** An open-source penetration testing tool used to automate the process of detecting and exploiting SQL injection flaws.
* **Cobalt Strike:** Used for post-exploitation and maintaining persistence.
* **Dirsearch:** Used for web path brute-forcing and discovery.
* **Infrastructure:**
* **C2/Domains:**
* dns-supports[.]online
* windows.updates[.]wiki
* **IP Addresses:**
* 212.60.5[.]129
* 38.54.40[.]156
## Implications
GambleForce represents a significant threat to data privacy in the APAC region. Their reliance on well-known, automated tools like `sqlmap` demonstrates that even basic, unpatched SQL injection vulnerabilities remain a high-impact risk for large organizations. The successful exfiltration of user credentials suggests a high risk of follow-on attacks, including identity theft, account takeover (ATO), and potential lateral movement within government or corporate networks.
## Mitigations
* **Input Validation & Parameterized Queries:** Implement prepared statements (parameterized queries) to ensure the database treats user input as data rather than executable code.
* **Vulnerability Management:** Regularly perform web application security testing and penetration testing to identify and patch SQL injection vulnerabilities.
* **Web Application Firewall (WAF):** Deploy and configure a WAF to detect and block common SQL injection patterns and malicious bot activity.
* **Network Traffic Analysis (NTA):** Utilize NTA and XDR solutions to monitor for suspicious outbound data transfers and connections to known malicious IPs/domains.
* **Principle of Least Privilege:** Ensure database accounts used by web applications have the minimum permissions necessary to function, limiting the potential scope of an injection attack.