Online Casinos at risk: Cyberattack by APT41
•
22 Oct 2024 •
Reading time: 2 minutes The online gambling industry, already heavily regulated, is facing a new threat: cyberattacks. Specifically, the Chinese hacking group APT41, known for its espionage and cybercrime operations, has targeted several online casinos around the world.
“Over a period of at least six months, the attackers stealthily collected valuable information from the targeted company, including but not limited to network configurations, user passwords, and LSASS process secrets.”
Ido Naor, co-founder and CEO of Israeli cybersecurity firm Security Joes
This intrusion allowed APT41 to penetrate deep into its victims’ systems.
A methodical attack
Security Joes described APT41 as both “highly skilled and methodical.” They highlighted their ability to launch espionage attacks as well as poison the supply chain, enabling intellectual property theft. Their intrusions were clearly motivated by financial motives such as ransomware and cryptocurrency mining.
The initial access vector used in this attack is currently unknown, but evidence suggests it may have been spearphishing emails.
Once inside the network, the attackers executed, among other things, a DCSync attack, aimed at harvesting password hashes of service and administrator accounts to extend their access.
Over time, the attackers adapted their toolkit to bypass the measures taken against them and escalate their privileges. Their goal was to collect critical information and establish covert channels for persistent remote access. The stolen data was exfiltrated to servers controlled by the hackers.
The attack, which targeted one of Security Joes’ clients, lasted nearly nine months and shares similarities with a series of intrusions tracked by cybersecurity vendor Sophos under the name Operation Crimson Palace.
Far-reaching consequences
The consequences of these attacks are multiple and serious. For online casinos, they can result in significant financial losses, reputational damage, and legal action. For players, the risk of identity theft and financial loss is real. In addition, these attacks can impact consumer confidence in online gaming.
“These attacks depend on state-sponsored decision-makers. This time, we suspect with high confidence that APT41 was seeking financial gain.”
Ido Naor
This statement suggests that APT41’s motivations go beyond industrial espionage and may include a financial component.