These attacks specifically utilize Cobalt Strike, a legitimate adversary simulation tool designed for security professionals, and SQLMap, an open-source utility that automates the detection and exploitation of SQL injection vulnerabilities. The attackers typically begin by scanning for vulnerable web endpoints using automated tools, focusing particularly on legacy applications that may have escaped regular security updates. Threat actors are increasingly leveraging professional security tools including Cobalt Strike, SQLMap, and other reconnaissance utilities to compromise corporate networks with alarming effectiveness. Once a vulnerable target is identified, they deploy SQL injection attacks against database-connected applications to extract authentication credentials and other sensitive information. The attacks typically begin with vulnerable web application components and escalate to full network access, allowing attackers to steal sensitive data and deploy ransomware payloads. Security teams are advised to implement web application firewalls, conduct regular vulnerability scanning, and maintain rigorous patch management procedures to defend against these increasingly sophisticated attacks. From there, attackers typically download Cobalt Strike beacons configured to communicate with command and control servers through encrypted channels using domain fronting techniques to evade detection. The researchers traced several recent breaches to initial SQL injection attacks that later incorporated Cobalt Strike beacons for persistent access. A common pattern seen across multiple victims involves the use of queries similar to: ' UNION SELECT @@version, user(), database(), sleep(5) -- - which both extracts database information and validates successful injection points. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The combination of these tools creates a potent arsenal for attackers seeking to breach organizational defenses through their web-facing applications. Cybersecurity experts have uncovered a sophisticated campaign targeting enterprise web applications through the abuse of legitimate penetration testing tools. Their research shows attackers are specifically targeting outdated web applications with known vulnerabilities that organizations have failed to patch.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 19 Mar 2025 12:35:19 +0000