- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2023
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0301 · gambleforce
ChinaWhat it is
GambleForce is a threat actor specializing in SQL injection attacks. They have targeted over 20 websites in various sectors across multiple countries, compromising six companies. GambleForce utilizes publicly available pentesting tools and has been active since mid-September 2023.
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Australia, Brazil, China, India, Indonesia, Philippines, South Korea, Thailand
- Sectors
- Casinos and Gambling, Government, Hospitality, Retail
Tools
The tools and malware families the sources tie to it.
- Cobalt Strike
- CrossRat
- Dirsearch
- Tinyproxy
- redis-rogue-getshell
- sqlmap
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de