Full Report
ResumeLooters gang infects websites with XSS scripts and SQL injections to vacuum up job seekers' personal data and CVs
Analysis Summary
# Threat Actor: ResumeLooters
## Attribution & Identity
* **Identification:** ResumeLooters is a financially motivated cybercriminal group first identified by Group-IB.
* **Aliases:** None currently known; identified specifically by their activity targeting recruitment and retail databases.
* **Known Associations:** The group appears to operate independently, though they utilize common penetration testing and scanning tools popular in the cybercriminal underground.
## Activity Summary
ResumeLooters is currently active in a large-scale campaign focused on the mass theft of personal data and Curriculum Vitae (CVs). Between late 2023 and early 2024, the group successfully compromised dozens of websites to "vacuum" up job seeker information. Their operations typically involve a two-stage process: first, identifying vulnerable web applications, and second, using SQL injection (SQLi) or Cross-Site Scripting (XSS) to exfiltrate database records or intercept user input.
## Tactics, Techniques & Procedures
The group focuses on web application exploitation to gain unauthorized access to backend databases.
* **Reconnaissance:** Uses automated tools like **Dirsearch** to map file structures and directories.
* **Vulnerability Research:** Employs **X-Ray** and **Acunetix** scanners to identify exploitable flaws.
* **Injection Attacks:** Primary methods of entry are SQL Injection to dump databases and XSS to execute malicious scripts in users' browsers.
* **Post-Exploitation:** Upon gaining shell access, the group utilizes PowerShell to download and execute secondary payloads (e.g., `shell3.exe`).
**MITRE ATT&CK IDs:**
* **T1595.002:** Vulnerability Scanning (X-Ray, Acunetix)
* **T1595.003:** Wordlist Scanning (Dirsearch)
* **T1583.001:** Acquire Infrastructure: Domains
* **T1583.004:** Acquire Infrastructure: Server
* **T1189:** Drive-by Compromise (XSS)
* **T1190:** Exploit Public-Facing Application (SQLi)
* **T1059.001:** Command and Scripting Interpreter: PowerShell
## Targeting
* **Sectors:** Primarily Human Resources (HR), Recruitment, and Retail.
* **Geography:** Global focus, with significant activity noted in the **APAC** region (specifically India, Taiwan, and Thailand).
* **Victims:** Job seekers and recruitment platforms. Specifically mentioned targets/impersonated domains include `iimjobs[.]asia` and `foundit[.]asia`.
## Tools & Infrastructure
* **Malware/Tools:**
* **Scanners:** Acunetix, X-Ray.
* **Discovery:** Dirsearch.
* **Payloads:** Custom PowerShell scripts and executable shells (e.g., `shell3.exe`).
* **Infrastructure:**
* **IP Addresses:**
* 139.84.130[.]232
* 139.84.168[.]189
* 139.84.62[.]151
* 173.199.122[.]65
* 139.180.137[.]107
* **Domains:**
* recruit.iimjobs[.]asia
* recruiter.foundit[.]asia
* admin.cloudnetsofe[.]com
* 8t[.]ae
* sb8[.]co
* qu3[.]cc
* 8r[.]ae
* 3x1[.]me
* 7o[.]ae
* 9gp[.]cc
## Implications
ResumeLooters represents a significant threat to the privacy of job seekers. The stolen data (PII and CVs) is highly valuable for secondary attacks, including targeted phishing (spear-phishing), identity theft, and corporate espionage. Their ability to compromise legitimate recruitment platforms undermines trust in digital HR ecosystems and creates a supply chain risk for companies relying on these third-party services.
## Mitigations
* **Input Validation:** Implement strict server-side validation and parameterized queries to prevent SQL injection.
* **Content Security Policy (CSP):** Deploy robust CSP headers to mitigate the impact of Cross-Site Scripting (XSS).
* **Vulnerability Management:** Regularly perform web application security testing and patch public-facing applications immediately.
* **Bot Management:** Use AI-driven bot protection to distinguish between legitimate user traffic and automated scanners (like Acunetix/Dirsearch).
* **Monitoring:** Monitor for unusual PowerShell execution on web servers and outbound connections to the identified malicious IPs/domains.