MySQL Servers Targeted in Ransomware Attack

MySQL databases that are connected to the internet are being targeted across the globe in a double extortion campaign called PLEASE_READ_ME by researchers.

This campaign has breached over 83,000 internet-facing MySQL databases out of the five million that exist worldwide. The simple attack works by using file-less ransomware to exploit weak credentials in MySQL servers and after they have gained entry, the hackers lock the database and steal the victim’s data. They also leave a backdoor on the database which would allow for re-entry into the network.

The attack involves double extortion because in trying to make a profit, they use two different methods. Firstly, they attempt to blackmail the victim for the victims to retrieve access to their data and secondly, they will sell the stolen data to the highest bidder. Researchers found that just over one Bitcoin or just under 25,000 USD had been transferred to the wallets. Furthermore, the researchers noted that the attackers have been able to offer more than 250,000 databases on a dark web auction site so far.