Hackers Exploit Legitimate Commands to Breach Databases

Hackers are increasingly using legitimate database commands to breach systems, rather than deploying new malware. They exploit built‑in queries such as DROP, DELETE or EXPORT after authenticating to misconfigured services, exfiltrating data to attacker‑controlled hosts and sometimes wiping targets before leaving ransom notes inside the database.

The campaign is highly automated, widely distributed, and targets exposed databases worldwide, with attackers scanning the Internet for open ports such as MySQL on 3306, PostgreSQL on 5432, and MongoDB on 27017. In many cases, victims discover their data missing or inaccessible, and ransom notes stored within the database themselves, a malware‑less approach that has evolved into double extortion tactics threatening public data leaks if ransoms go unpaid.

Preventative measures emphasise network segmentation, private database networks shielded by firewalls, and disabling internet exposure of database ports, alongside strict authentication controls, MFA for administrative accounts and robust backups, with continuous IOC monitoring and real‑time scanning by Wiz Dynamic Scanner.

These campaigns, documented since February 2017, show that successful database takeovers can enable privilege escalation and lateral movement, underscoring the need for proactive detection and strong configurations.