Hackers Exploit Legitimate Commands to Breach Databases

Cybersecurity: Emerging Trends in Database Ransomware

Recent trends indicate a shift in attack strategies, with adversaries increasingly favoring "living-off-the-land" operations over traditional malware. These operations target cloud and SaaS environments, exploiting misconfigured database services to steal, destroy, or encrypt data using built-in commands.

Unlike traditional ransomware, which requires a malicious payload to encrypt files, database ransomware utilizes standard queries such as DROP, DELETE, or EXPORT to render data inaccessible. Attackers often scan for open ports, including MySQL (3306), PostgreSQL (5432), and MongoDB (27017), to exploit weak or default credentials. Upon gaining access, they may exfiltrate data, wipe databases, and leave ransom notes within the database itself.

Distribution of ransomware hits by Database.

This method bypasses many endpoint security tools, as no foreign binary is installed. The approach was first documented in large-scale hijackings in early 2017 and has since evolved into automated campaigns targeting exposed databases globally.

Recent campaigns have incorporated double extortion tactics, threatening to publish stolen data if ransoms remain unpaid, regardless of whether data exfiltration is confirmed. This strategy increases pressure on victims to comply with demands.

Database takeover can also facilitate privilege escalation, allowing attackers to execute remote code, pivot to other hosts, and establish persistent access. A ransom note in a database may indicate a more significant compromise, with potential for lateral movement and long-term data theft.

Implement network segmentation to isolate database servers on private networks, protected by firewalls and security groups. Eliminate direct Internet exposure of database ports. Use a hardened jump server with multi-factor authentication for remote administration. Enforce strong, unique credentials and require multi-factor authentication for administrative accounts. Regularly audit configurations to remove default usernames and weak passwords. Establish robust backup strategies, ensuring frequent backups are validated and stored in secure locations.

Continuous monitoring for Indicators of Compromise (IOCs) is crucial. Automated scans should identify new tables or collections suggestive of ransom notes. Anomalous bulk DELETE or DROP operations warrant immediate investigation. Proactive mapping of attack surfaces can help identify vulnerabilities before they are exploited.

Wiz customers can benefit from agentless scanning that identifies public database instances and real-time misconfigurations.

Based on reporting by GBHackers.