An active ransomware campaign targeting MySQL database servers is pressuring victims into paying ransom by posting and selling stolen information on the Dark Web, researchers report.
The campaign, which Guardicore Labs calls “Please_Read_Me,” started as early as January 2020. At least 85,000 servers have been breached so far. Since multiple databases are usually stolen from a single victim, the attackers have 250,000 databases offered for sale in their dashboards.
The first attack was detected on Jan. 24; since then, a total of 92 attacks have been reported by Guardicore’s sensors. Attacks originate from 11 different IP addresses, most of which are from Ireland and the United Kingdom.
Two variants of this campaign have been observed this year. In the first, which ran from January through the end of November, attackers left a ransom note with their…