85K MySQL Servers were hit by PLEASE_READ_ME Ransomware

Ransomware actors behind the attack are currently selling at least compromised 250,000 databases.

PLEASE_READ_ME is the name of the database attackers create on the compromised MySQL server. And since this is an open-source relational database management system, the attack exploits weak credentials, using brute-force, erasing the content from the database, and leaving a brief note instead. The note is placed in a table named “WARNING” and demands up to 0.08BTC to be payed as ransom. The ransom note contains the following message “Your databases are downloaded and backed up on our servers. If we dont receive your payment in the next 9 Days, we will sell your database to the highest bidder or use them otherwise.”

The attack is very simple, using just a script to break into the database. A backdoor is also added for persistence and future access. The bad actors behind this attack, managed to successfully attack 85000 servers.

Check the source.

Read More

• H0lyGh0st Ransomware After Small and Midsize Businesses
  Microsoft has linked H0lyGh0st, a cyberthreat that emerged in June 2021 and targets small-to-midsized businesses, to North Korean state-sponsored […]
• Popular NFT Marketplace Ravaged by $540M Phishing Scheme
  In March, a North Korean APT netted $540 million thanks to a massive phishing operation carried out on the […]
• Massive $59M Facebook Phishing Campaign Steals Nearly 400M Credentials
  Threat actors have managed to net a staggering $59 million and steal hundreds of millions of credentials in a […]
• Human Error is a Top Security Risk in 2022, New Report Shows
  A new report from Verizon warns about the human error as being one of the most frequent causes of […]
• Paying The Ransom – An Open Invitation For A Second Attack, 2022 Report Warns
  Whether the unlucky victim of a ransomware attack ends up paying the ransom or not, they are still susceptible […]