{"id":33404,"date":"2020-02-19T14:57:20","date_gmt":"2020-02-19T14:57:20","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/30950\/Chinese-Hackers-Have-Breached-Online-Betting-And-Gambling-Sites.html"},"modified":"2020-02-19T14:57:20","modified_gmt":"2020-02-19T14:57:20","slug":"chinese-hackers-have-breached-online-betting-and-gambling-sites","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/chinese-hackers-have-breached-online-betting-and-gambling-sites\/","title":{"rendered":"Chinese Hackers Have Breached Online Betting And Gambling Sites"},"content":{"rendered":"

\"gambling<\/span>Image via Amanda Jones<\/span> <\/p>\n

\n

Special feature<\/span><\/h3>\n
\"Cyberwar<\/span><\/a><\/div>\n

Cyberwar and the Future of Cybersecurity<\/a><\/p>\n

Today’s security threats have expanded in scope and seriousness. There can now be millions — or even billions — of dollars at risk when information security isn’t handled properly.<\/p>\n

Read More<\/a><\/p>\n<\/div>\n

Since the summer of 2019, a group of professional Chinese hackers has been targeting and hacking into companies that run online gambling and online betting websites.<\/p>\n

According to reports published this week by cyber-security firms Talent-Jump and Trend Micro, hacks have been officially confirmed at gambling companies located in Southeast Asia, while unconfirmed rumors of additional hacks have also come from Europe and the Middle East.<\/p>\n

Talent-Jump and Trend Micro say hackers appear to have stolen company databases and source code, but not money, suggesting the attacks were espionage-focused, rather than cybercrime motivated.<\/p>\n

The two security firms said the attacks had been carried out by a group they called DRBControl.<\/p>\n

Trend Micro said the group’s malware and operational tactics overlap with similar tools and tactics used by Winnti and Emissary Panda, two hacking groups that have conducted attacks over the past decade in the interests of the Chinese government.<\/p>\n

Currently, it is unclear if DRBControl is carrying out attacks on behalf of Beijing. Most likely not. In August 2019, cyber-security firm FireEye reported that some Chinese state-sponsored hacking groups are now carrying out cyber-attacks on the side<\/a>, in their free time, for their own gains and interests, separate from their normal state-sponsored operations.<\/p>\n

DRBControl modus operandi<\/h3>\n

The recent DRBControl attacks are neither complex or unique in regards to the tactics being used to infect victims and steal their data.<\/p>\n

\n<\/section>\n

Attacks start with a spear-phishing link sent to targets. Employees who fall for the emails and open the documents they received are infected with backdoor trojans.<\/p>\n

These backdoor trojans are somewhat different from other backdoors because they heavily rely on the Dropbox file hosting and file sharing service, which they use as a command-and-control (C&C) service and as a storage medium for second-stage payloads and stolen data — hence the group’s name of DRopBox Control.<\/p>\n

Typically, the Chinese hackers will use the backdoors to download other hacking tools and malware that they’ll use to move laterally through a company’s network until they find databases and source code repositories from where they can steal data.<\/p>\n

Tools DRBControl has been seen downloading and using include:<\/p>\n