Article Details
Scrape Timestamp (UTC): 2024-08-03 04:02:33.474
Source: https://thehackernews.com/2024/08/hackers-exploit-misconfigured-jupyter.html
Original Article Text
Click to Toggle View
Hackers Exploit Misconfigured Jupyter Notebooks with Repurposed Minecraft DDoS Tool. Cybersecurity researchers have disclosed details of a new distributed denial-of-service (DDoS) attack campaign targeting misconfigured Jupyter Notebooks. The activity, codenamed Panamorfi by cloud security firm Aqua, utilizes a Java-based tool called mineping to launch a TCP flood DDoS attack. Mineping is a DDoS package designed for Minecraft game servers. Attack chains entail the exploitation of internet-exposed Jupyter Notebook instances to run wget commands for fetching a ZIP archive hosted on a file-sharing site called Filebin. The ZIP file contains two Java archive (JAR) files, conn.jar and mineping.jar, with the former used to establish connections to a Discord channel and trigger the execution of the mineping.jar package. "This attack aims to consume the resources of the target server by sending a large number of TCP connection requests," Aqua researcher Assaf Morag said. "The results are written to the Discord channel." The attack campaign has been attributed to a threat actor who goes by the name yawixooo, whose GitHub account has a public repository containing a Minecraft server properties file. This is not the first time internet-accessible Jupyter Notebooks have been targeted by adversaries. In October 2023, a Tunisian threat dubbed Qubitstrike was observed breaching Jupyter Notebooks in an attempt to illicitly mine cryptocurrency and breach cloud environments.
Daily Brief Summary
Cybersecurity researchers discovered a DDoS attack exploiting misconfigured Jupyter Notebooks.
The attack, named Panamorfi, uses a Java tool originally designed for Minecraft called mineping.
Attackers initiate the attack through wget commands to download malicious Java files from a file-sharing site.
Compromised Jupyter Notebooks are used to flood target servers with TCP connection requests, overloading them.
Attack outcomes and updates are systematically reported to a Discord channel via bots.
The threat actor associated with these attacks is identified as yawixooo, who is active on GitHub.
This incident underscores ongoing security risks to internet-exposed Jupyter Notebooks, previously targeted for different cybercrimes such as cryptocurrency mining.