{"id":5745,"date":"2025-07-30T10:08:25","date_gmt":"2025-07-30T10:08:25","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/07\/30\/lionishackers-threat-actors-exfiltrating-and-selling-corporate-databases-on-dark-web\/"},"modified":"2025-07-30T10:08:25","modified_gmt":"2025-07-30T10:08:25","slug":"lionishackers-threat-actors-exfiltrating-and-selling-corporate-databases-on-dark-web","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/07\/30\/lionishackers-threat-actors-exfiltrating-and-selling-corporate-databases-on-dark-web\/","title":{"rendered":"Lionishackers Threat Actors Exfiltrating and Selling Corporate Databases on Dark Web"},"content":{"rendered":"

Lionishackers Threat Actors Exfiltrating and Selling Corporate Databases on Dark Web
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A financially motivated threat actor known as Lionishackers has emerged as a significant player in the illicit marketplace for corporate data in recent months.<\/p>\n

Leveraging opportunistic targeting and a preference for Asian-based victims, the group employs automated SQL injection tools to breach database servers, exfiltrate sensitive records, and list them for sale on underground forums and Telegram channels.<\/p>\n

Though not overtly ransomware-based, their model reflects a form of \u201cdouble extortion\u201d by monetizing stolen data directly rather than encrypting and demanding payment for decryption.<\/p>\n

Outpost24 analysts noted that Lionishackers initially surfaced in September 2024, quickly establishing a reputation through proof-of-compromise screenshots and sample excerpts shared across multiple underground platforms.<\/p>\n

The group\u2019s communication strategy involves maintaining numerous forum aliases\u2014each tied to identical Telegram contact information\u2014thereby evading long-term attribution while preserving buyer outreach.<\/p>\n

Their services have diversified beyond corporate records to include social media and email credential databases, as well as ancillary offerings such as DDoS botnets and forum hosting projects.<\/p>\n

As Lionishackers\u2019 activity accelerated, their impact on targeted organizations became increasingly apparent. Victims span government bodies, telecommunications firms, pharmaceutical companies, educational institutions, retail chains, and notably, gambling sites.<\/p>\n

Data sets exfiltrated have included personally identifiable information (PII), financial records, and authentication credentials\u2014elements readily exploited for identity theft, account takeover, or corporate espionage.<\/p>\n

The group\u2019s tactics underscore the growing potency of database-focused cybercrime, which can inflict profound reputational and financial harm without deploying traditional ransomware.<\/p>\n

Outpost24 researchers identified<\/a> that the group\u2019s specialization in SQL-based attacks and reliance on widely available automation frameworks enable rapid compromise and scaling.<\/p>\n

The transition from isolated database sales to additional offerings\u2014such as the Ghost botnet for network-layer DDoS\u2014demonstrates their evolving criminal enterprise.<\/p>\n

\n
\"\"
Lionishackers commercializing the Ghost botnet in Telegram (Source \u2013 Outpost24)<\/figcaption><\/figure>\n<\/div>\n

A Telegram advertisement showcasing Ghost\u2019s capabilities. While the short-lived \u201cStressed Forums\u201d project launched amid law enforcement scrutiny of BreachForums<\/a>.<\/p>\n

\n
\"\"
Lionishackers promoting the creation of the Stressed Forums (Source \u2013 Outpost24)<\/figcaption><\/figure>\n<\/div>\n

Infection Mechanism and Persistence Tactics<\/strong><\/h2>\n

A closer examination reveals that Lionishackers primarily exploit SQL injection<\/a> vulnerabilities in poorly configured web applications.<\/p>\n

By leveraging tools like SQLmap, they automate reconnaissance and payload delivery.<\/p>\n

A typical injection sequence observed by Outpost24 follows:-<\/p>\n

sqlmap -u \"https:\/\/victim.com\/product?id=1\" \n       --batch --dbs --threads=5 \n       --tamper=space2comment --time-sec=10<\/code><\/pre>\n
This command probes for injectable parameters, enumerates databases, and extracts table contents.<\/p>\n
Once credentials are retrieved, the attackers often reuse valid login information to pivot deeper into internal networks<\/a>.<\/p>\n
\n
\"\"
Lionishackers using the alias Captain Fen show preference in compromising casino sites (Source \u2013 Outpost24)<\/figcaption><\/figure>\n<\/div>\n
Persistence is achieved through the deployment of lightweight backdoors\u2014frequently simple web shells<\/a>\u2014hidden in temporary directories or disguised as innocuous update scripts.<\/p>\n
\n
\"\"
Post on Telegram listing some of the countries that Lionishackers would be specialized in (Source \u2013 Outpost24)<\/figcaption><\/figure>\n<\/div>\n
These shells facilitate ongoing data pulls and serve as fallback access points if the initial vulnerability is patched.<\/p>\n
By understanding Lionishackers\u2019 automation-driven SQL injection workflow and their nimble alias rotation across forums, defenders can prioritize application firewall<\/a> rules, enhance query parameterization, and implement continuous monitoring for anomalous database access patterns.<\/p>\n
Integrate\u00a0ANY.RUN TI Lookup<\/strong>\u00a0with your SIEM or SOAR To Analyses Advanced Threats<\/strong>\u00a0->\u00a0Try 50 Free Trial Searches<\/a><\/strong><\/p>\n
The post Lionishackers Threat Actors Exfiltrating and Selling Corporate Databases on Dark Web<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
Lionishackers Threat Actors Exfiltrating and Selling Corporate Databases on Dark Web A financially motivated threat actor known as Lionishackers has emerged as a significant player in the illicit marketplace for corporate data in recent months. Leveraging opportunistic targeting and a preference for Asian-based victims, the group employs automated SQL injection tools to breach database servers, […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-5745","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/5745"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=5745"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/5745\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=5745"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=5745"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=5745"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}