Ace in the Hole: exposing GambleForce, an SQL injection gang

Group-IB discovered and tracked GambleForce, a threat actor using basic SQL injection techniques and open-source pentesting tools to target 24 websites (government, gambling, retail, travel, and job sites) across Australia, China, Indonesia, the Philippines, India, South Korea, Thailand and Brazil; the actors successfully exfiltrated user databases from six victims, operated a Cobalt Strike teamserver with custom profiles and self-signed certs, and used other utilities like supershell, while Group-IB took down their C2 and published IoCs and mitigation guidance.