Ankura CTIX FLASH Update - February 9, 2024

Ransomware/Malware Activity

XSS Attacks Impact Millions

A new threat group going by the name "ResumeLooters" has used a series of SQL injections and cross-site scripting (XSS) attacks targeting dozens of jobs listing sites, retail sites, and even real estate websites to extract personal data from millions of people. Primarily targeting Asia and Australia, the threat actors exfiltrated individuals' names, emails, phone numbers, and other personal information. ResumeLooters used a variety of tools including SQLmap and Acunetix, both of which are used to detect and exploit SQL injection flaws automatically. After using these common tools to identify their targets, the threat actor injected scripts into the website's HTML. It has been noted that occasionally the injection of the HTML scripts is done improperly and poorly, even to the point of showing up on the website itself and making it obvious that there has been an attempted attack. However, when the injection is