February 28, 2017 By Larry Loeb 2 min read

In January, security researchers reported that MongoDB servers had sustained disastrous wave of attacks. Now, analysts from GuardiCore believe they have discovered a similar campaign affecting MySQL databases.

MySQL Database Goes the Way of MongoDB

Though these particular MongoDB databases may have either been badly configured or not configured at all to be public-facing, the January strike was still a new and virulent kind of attack. Eventually, it spread to an estimated 30,000 databases. The ransomware in question demanded 0.2 bitcoin for victims to recover their data.

SecurityWeek reported that the same sort of ransomware spread to attack ElasticSearch clusters, Hadoop and CloudDB databases. Worse, the attackers might simply delete the stolen data rather than return it, even if the ransom is paid. Researchers also found that multiple actors compete within the same database to have the most current ransom note and thus receive payment.

How the Attack Works

A more detailed account of the attack was posted on GuardiCore’s blog. The security firm reported that cybercriminals first search for servers that are secured with weak passwords. Then they try to brute-force these servers to gain a foothold, followed by elevated access. Once in all the way, the actors replace the database contents with their own table, which includes a ransom note.

The threat actors appeared to use many of the same techniques in this campaign as they did in January’s MongoDB attacks. Their multiple overwriting method, in particular, has proven to be extremely destructive. Additionally, GuardiCore said it found no evidence of data dumps or data exfiltration during any of the MySQL attacks they monitored, which means the attackers made no attempt to save prior data.

Looking for Low-Hanging Fruit

Mitigation comes, in this case, from using strong passwords and mandatory authentication for any internet-facing systems. Brute-force is a rather inefficient attack method, and cybercriminals who employ this technique are almost always looking for low-hanging fruit.

Users and organizations can vastly improve their security postures by conducting simple password audits and following basic online security best practices.

More from

Airplane cybersecurity: Past, present, future

4 min read - With most aviation processes now digitized, airlines and the aviation industry as a whole must prioritize cybersecurity. If a cyber criminal launches an attack that affects a system involved in aviation — either an airline’s system or a third-party vendor — the entire process, from safety to passenger comfort, may be impacted.To improve security in the aviation industry, the FAA recently proposed new rules to tighten cybersecurity on airplanes. These rules would “protect the equipment, systems and networks of transport…

Protecting your digital assets from non-human identity attacks

4 min read - Untethered data accessibility and workflow automation are now foundational elements of most digital infrastructures. With the right applications and protocols in place, businesses no longer need to feel restricted by their lack of manpower or technical capabilities — machines are now filling those gaps.The use of non-human identities (NHIs) to power business-critical applications — especially those used in cloud computing environments or when facilitating service-to-service connections — has opened the doors for seamless operational efficiency. Unfortunately, these doors aren’t the…

Communication platforms play a major role in data breach risks

4 min read - Every online activity or task brings at least some level of cybersecurity risk, but some have more risk than others. Kiteworks Sensitive Content Communications Report found that this is especially true when it comes to using communication tools.When it comes to cybersecurity, communicating means more than just talking to another person; it includes any activity where you are transferring data from one point online to another. Companies use a wide range of different types of tools to communicate, including email,…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today