Malwareless Ransomware pwned database

A “malwareless” ransomware campaign delivered from UK IP addresses targeting weak security controls around internet-facing SQL servers successfully pwned 83,000 victims, according to Israeli infosec biz Guardicore.

“The attack chain is extremely simple and exploits weak credentials on internet-facing MySQL servers”

Once the database servers are compromised, the miscreants operating the campaign begin a so-called “double extortion” attack, threatening to publish data exfiltrated from the SQL silos unless victims pay a ransom, which also apparently will lead to the restoration of that data.

Holding people’s files and records to ransom has become synonymous with application-level malware infections. What we have here is a reminder that crooks can scramble information from afar without having to run bad apps on employees’ workstations or host servers.

Around 1.2 Bitcoins (~$25,000) was deposited to wallet, with a total of 250,000 breached databases being offered for sale. Over time the campaign stepped up, sharply increasing in October with the apparent release of a second version.

The website is a good example of a double extortion mechanism – it contains all leaked databases for which ransom was not paid. The website lists 250k different databases from 83k MySQL servers, with 7TB of stolen data. Up till now,captured 29 incidents of this variant, originating from 7 different IP addresses .

There are no binary payloads involved in the attack chain, making the attack ‘malwareless’. Only a simple script which breaks in the database, steals information, and leaves a message.

Internet-facing MySQL databases used by WordPress are pretty common. Contained in those databases are username and login information for the site they power, which could prove troublesome if users – not just site admins but also article authors and comment posters – recycle their credential pairs elsewhere.

“Double extortion” was last in the news when footie super-club Manchester United was struck by ransomware last month. The technique isn’t new but the handy name for it is relatively so.