Hackers Actively Compromising Databases Using Legitimate Commands

Cybersecurity: Database Ransomware Attacks

Recent advancements in ransomware tactics involve the use of legitimate database commands to compromise systems globally. This approach allows attackers to bypass traditional security measures through operations that do not rely on malware.

Unlike traditional ransomware, which employs malicious binaries to encrypt files, attackers now exploit exposed database services. By abusing standard database functionality, they are able to steal, wipe, and ransom critical data.

Attackers focus on Internet-facing database servers, particularly those configured with weak passwords or lacking authentication. This method is observed across various database platforms, including MySQL, PostgreSQL, MongoDB, Hadoop, CouchDB, and Elasticsearch. Attackers connect remotely, copy data to external locations, execute commands to wipe databases, and store ransom notes within the compromised structures.

The use of legitimate commands makes detection difficult for conventional endpoint security solutions, as no malicious binaries are involved in the compromise.

The tactic has evolved into automated campaigns, with bots scanning the Internet for misconfigured databases. These attacks have grown significantly since their initial documentation in February 2017, when thousands of open databases were hijacked in bulk operations.

Today's threat actors leverage sophisticated automated systems to identify and compromise new targets rapidly. The potential for immediate profits has made this form of ransomware a persistent threat.

Attack Execution and Command Exploitation

Attackers begin by scanning for exposed database ports, targeting port 3306 for MySQL and 5432 for PostgreSQL. They employ fingerprinting techniques to confirm the legitimacy of database services.

Authentication bypass is a critical phase, involving tests for missing authentication controls, default credentials, and brute-force attacks. Upon successful authentication, attackers extract data samples to assess value and confirm access.

The destructive phase utilizes legitimate SQL commands, such as DROP DATABASE or bulk DELETE , to erase data. Attackers create new tables or collections with ransom notes in relational and NoSQL databases, respectively.

For instance, in MongoDB sessions, attackers execute commands like mongosh "mongodb://target:27017/" and show dbs to identify targets. Ransom notes typically demand payment in cryptocurrency, threatening data exposure if demands are unmet.

The use of legitimate operations complicates detection, as monitoring systems may interpret these as normal administrative activities.

Based on reporting by Cyber Security News.