Skip to main content

PLEASE_READ_ME Ransomware Campaign

First observed in January this year, PLEASE_READ_ME is a simple ransomware campaign targeted at publicly facing MySQL data servers.

Threat ID:
CC-3705
Category:
Ransomware
Threat Severity:
Medium
Threat Vector:
Insecure network
Published:
16 December 2020 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

First observed in January this year, PLEASE_READ_ME is a simple ransomware campaign targeted at publicly facing MySQL data servers.

Affected platforms

The following platforms are known to be affected:

Internet-facing MySQL servers

Threat details

Introduction

PLEASE_READ_ME is a newly observed human-operated ransomware campaign targeting exposed MySQL servers. Believed to have been operating since January 2020, the campaign claims to have seized 250,000 databases from vulnerable systems.

Delivery & activities

All PLEASE_READ_ME infections begin with brute-force or default credential reuse attacks against internet-facing servers. These attacks appear to be untargeted, instead attempting to attack almost all public facing servers.

Once access is achieved, a shell script is dropped and executed on the affected server. This script runs a series of queries to enumerate all databases present on there server, before extracting them to a ZIP archive file and sending that to an attacker-controlled location.

All extracted databases are then hidden on a public leak site, with PLEASE_READ_ME's operators threatening to leak affected organisations data if they do not meet their ransom demands.

Remediation advice

If a device on your network becomes infected with ransomware it will begin encrypting files, which may also include remote files on network locations. The only guaranteed way to recover from a ransomware infection is to restore all affected files from their most recent backup. To limit the impact of a ransomware infection, NHS Digital advises that:

  • Critical data is frequently saved in multiple backup locations.
  • At least one backup is kept offline at any time (separated from live systems).
  • Backups and incident recovery plans are tested to ensure that data can be restored when needed.
  • User account permissions for modifying data are regularly reviewed and restricted to the minimum necessary.
  • Infected systems are disconnected from the network and powered down as soon as practicable.
  • Any user account credentials that may have been compromised should be reset on a clean device
  • Where infected systems cannot be quarantined with confidence, then an affected organisation should disconnect from national networks to limit propagation.

Additionally, to prevent and detect an infection, NHS Digital advises that:

  • Secure configurations are applied to all devices.
  • Security updates are applied at the earliest opportunity.
  • Tamper protection settings in security products are enabled where available.
  • Obsolete platforms are segregated from the rest of the network.
  • IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
  • Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
  • Administrative accounts are only used for necessary purposes.
  • Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
  • Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.

Indicators of compromise

Network indicators

IP addresses

  • 145[.]239[.]255[.]222
  • 167[.]114[.]145[.]131
  • 176[.]111[.]173[.]38
  • 176[.]111[.]173[.]64
  • 185[.]234[.]216[.]247
  • 185[.]234[.]216[.]38
  • 185[.]234[.]218[.]239
  • 185[.]234[.]218[.]42
  • 193[.]169[.]252[.]34
  • 195[.]182[.]158[.]247
  • 37[.]187[.]127[.]10

URLs

  • http://hn4wg4o6s5nc7763.onion

Last edited: 17 December 2020 1:22 pm