How Ransomware Hijacks MySQL and What You Can Do to Stop It

Ransomware targeting MySQL

Attackers compromise MySQL after gaining access to other databases (MongoDB, ElasticSearch, Hadoop, CouchDB, Cassandra). They obtain root privileges, create a database or table named WARNING, and insert a ransom note demanding 0.2 BTC. The note provides either an email address or a .onion URL for victims to retrieve their data.

Ransom note payloads

INSERT INTO PLEASE_READ.`WARNING`(id, warning, Bitcoin_Address, Email) VALUES('1','Send 0.2 BTC to this address and contact this email with your ip or db_name of your server to recover your database! Your DB is Backed up to our servers!','1ET9NHZEXXQ34qSP46vKg8mrWgT89cfZoY','[email protected]');

INSERT INTO `WARNING`(id, warning) VALUES(1,'SEND 0.2 BTC TO THIS ADDRESS 1Kg9nGFdAoZWmrn1qPMZstam3CXLgcxPA9 AND GO TO THIS SITE http://sognd75g4isasu2v.onion/ TO RECOVER YOUR DATABASE! SQL DUMP WILL BE AVAILABLE AFTER PAYMENT! To access this site you have to use the tor browser https://www.torproject.org/projects/torbrowser.html.en');

Mitigation steps

a) Strengthen authentication

MySQL defaults to requiring a password, but weak passwords are common. Change the root password using any of the following methods:

UPDATE user table:

USE mysql;
UPDATE user SET password=PASSWORD('new_password') WHERE user='root';
FLUSH PRIVILEGES;

SET PASSWORD statement:

SET PASSWORD FOR 'root'@'localhost'=PASSWORD('new_password');

mysqladmin command:

mysqladmin -u root -p'old_password' password 'new_password'

b) Disable public network access

Set bind-address in my.cnf (or startup parameters) to an internal IP, e.g., bind-address = 127.0.0.1 or a specific LAN address.

Inspect the mysql.user table; change any entries where host='%' or non‑localhost to localhost or a specific IP, or remove unnecessary accounts.

c) Perform regular backups

Schedule periodic logical backups using mysqldump or physical backups with mysqlpump, store copies off‑site, and verify restore procedures.

d) Harden application reliability

Use only official MySQL client tools (e.g., mysql, mysqldump) downloaded from the vendor site; avoid cracked binaries.

Apply application‑level security such as prepared statements, input validation, and encryption to mitigate SQL injection and data exfiltration.

Adopting a managed relational database service can provide built‑in network isolation, automated backups, and patch management, reducing the operational burden on administrators.