ResumeLooters target job search sites in extensive data heist
Group-IB identified a large-scale malicious campaign primarily targeting job search and retail websites of companies in the Asia-Pacific region. The group, dubbed ResumeLooters, successfully infected at least 65 websites between November and December 2023 through SQL injection and XSS attacks. Most of the gang’s victims were found to be located in India, Taiwan, Thailand, Vietnam, China, and Australia.
ResumeLooters is confirmed to have stolen several databases containing 2,079,027 unique emails and other records, such as names, phone numbers, dates of birth, and information about job seekers’ experience and employment history.
The stolen data was then offered for sale by ResumeLooters in Telegram channels. The researchers issued notifications to the identified victims so they could take necessary measures to mitigate further damage.
Since beginning 2023, ResumeLooters has been utilizing several penetration testing frameworks and open-source tools, such as sqlmap, Acunetix, Beef Framework, X-Ray, Metasploit, ARL, and Dirsearch. As a result, the gang injected malicious SQL queries into 65 job search, retail, and other websites and retrieved a total of 2,188,444 rows, of which 510,259 were user data from employment websites.
Over 70% of known ResumeLooters’ victims are in the Asia-Pacific region. The gang is primarily focused on India (12 victims), Taiwan (10), Thailand (9), Vietnam (7), China (3), Australia (2), the Philippines (1), South Korea (1), and Japan (1). However, compromised websites have also been identified outside of APAC, including in Brazil, the USA, Turkey, Russia, Mexico, and Italy.
Researchers have established two Telegram accounts associated with the threat actor. Both accounts have been used to offer the stolen data for sale in Chinese-speaking Telegram groups dedicated to hacking and penetration testing.
“In less than two months, we have identified yet another threat actor conducting SQL injection attacks against companies in the Asia-Pacific region,” says Nikita Rostovcev, Senior Analyst at the Advanced Persistent Threat Research Team, Group-IB.
“It is striking to see how some of the oldest yet remarkably effective SQL attacks remain prevalent in the region. However, the tenacity of the ResumeLooters group stands out as they experiment with diverse methods of exploiting vulnerabilities, including XSS attacks. Additionally, the gang’s attacks cover a vast geographical area,” Rostovcev continued.
There is a noticeable increase in the interest of threat actors in the Asia-Pacific region.
In addition to SQL injection attacks, they have successfully executed XSS scripts on at least four legitimate job search websites. On one of these websites, the attackers implanted a malicious script by creating a fake employer profile. As a result, the attackers were able to steal the HTML code of the pages visited by the victims, including those with administrative access.
Malicious XSS scripts were also intended to display phishing forms on legitimate resources. It is believed that the attackers’ main goal was to steal admin credentials. However, no evidence of successful theft of administrative credentials was found.
To protect against injection attacks, companies are recommended to use parameterized or prepared statements instead of directly concatenating user input into SQL queries. It is essential to implement comprehensive input validation and sanitization on both the client and server sides. Performing regular security assessments and code reviews helps to identify and mitigate injection vulnerabilities.