1
Threat Overview
Ransomware attacks on exposed databases have caused significant damage, with 30,515 databases hit over 5 years, despite victims not paying. This threat exploits database vulnerabilities, causing data loss and disruption. Exposed databases are the primary attack vector.
2
Key Intelligence Points
1. The threat targets exposed databases, often using default or weak passwords. 2. The attack vector is database vulnerabilities, with no specific tool or CVE mentioned. 3. The attack chain involves unauthorized access to databases, followed by data encryption and extortion. 4. Detection opportunities include monitoring database access logs and network traffic for suspicious activity.
3
MITRE ATT&CK Techniques
T1110 - Brute Force
4
Mitigation & Detection
Implement robust database security measures, including multi-factor authentication, regular password rotations, and secure configuration settings.