Author: Melodie Foster

Date: 11th December 2020


MySQL databases that are connected to the internet are being targeted across the globe in a double extortion campaign called PLEASE_READ_ME by researchers.

This campaign has breached over 83,000 internet-facing MySQL databases out of the five million that exist worldwide. The simple attack works by using file-less ransomware to exploit weak credentials in MySQL servers and after they have gained entry, the hackers lock the database and steal the victim’s data. They also leave a backdoor on the database which would allow for re-entry into the network.

The attack involves double extortion because in trying to make a profit, they use two different methods. Firstly, they attempt to blackmail the victim for the victims to retrieve access to their data and secondly, they will sell the stolen data to the highest bidder. Researchers found that just over one Bitcoin or just under 25,000 USD had been transferred to the wallets. Furthermore, the researchers noted that the attackers have been able to offer more than 250,000 databases on a dark web auction site so far.

There have been two variations of this attack, the first was used from January to the end of November with 63 attacks, and the second started on October 3rd until the end of November. The first phase consisted of the attacker leaving a ransom note containing the amount of Bitcoin to pay, their wallet address and an email address for technical support, the victims were given 10 days to pay. In the second phase, however, the attacker did not use a Bitcoin wallet and instead opted for a website in the TOR network for victims to pay.[1]



Other resources

Cyberfort Colocation Services

Cyberfort has invested heavily in secure infrastructure, making us the perfect colocation service provider to host your mission-critical, sensitive and regulated data.
Find out more >

What can Cyberfort do for you?

Check out our factsheets for detailed information on the matrix of cybersecurity products and services we offer to protect your business.
Find out more >

Cyberfort Deep Dives

Cyberfort’s cybersecurity consultants explore issues in cyber threat intelligence, incident planning and data security. Read our whitepapers to help make decisions that benefit your business.
Find out more >