Varonis MySQL Honeypots Show Exposed Cloud Database Ransomed Within Hours

Summary

Varonis Threat Labs found that attackers brute-forced an intentionally exposed Google Cloud SQL honeypot, extracted decoy data and left ransom notes. Similar AWS RDS and Azure MySQL honeypots were not compromised.

Key points

The Google Cloud SQL honeypot used a weak root password and allowed unrestricted public access; brute-force attempts began within eight minutes.
Varonis says an attacker gained access after about 576 failed attempts, enumerated and extracted decoy data, dropped tables and created a Bitcoin ransom note.
After the instance was restored, a second attacker used the same brute-force approach and replaced the first ransom note.
The same experiment on Amazon RDS for MySQL and Azure MySQL Flexible Server did not result in compromise.
The investigation describes detection signals including repeated failed logins, unusual database enumeration, bulk queries and DROP TABLE operations.
Varonis emphasizes that customers remain responsible for database authentication, access control and monitoring in managed cloud services.

Article Details

Attack Vectors: Attackers repeatedly brute-forced a publicly accessible Google Cloud SQL for MySQL instance configured with a weak root password, eventually gaining database access.
After access, an attacker enumerated databases and tables, extracted decoy records, deleted tables, and created a ransom table with Bitcoin payment instructions.
A second attacker later used the same brute-force approach against the restored instance and replaced the first ransom note.
Defensive Notes: Use strong database credentials and restrict public access to authorized IP addresses or private connectivity.
Enable and retain database-level audit and data-access logs; these settings may require explicit configuration in managed database services.
Alert on repeated failed logins, unfamiliar reconnections, database enumeration, high-volume queries, and mass table deletions.