Combating "Ransom-War:" Landscape of Ransomware Infections in Cloud Databases

The talk looks at ransomware and botnet infections that target databases behind modern cloud applications, with a focus on MongoDB and Elasticsearch. The speaker argues that attackers now go after the data itself, since controlling a database lets them demand payment or destroy the data so that applications lose availability. The attack paths covered include exposed administrative interfaces, weak or default passwords, unpatched database software, compromised endpoints that pivot into cloud environments, and phishing of cloud account holders.

The middle of the talk walks through real infected instances seen during the research. Ransom notes appeared as collection or index names, and in some cases indices were encrypted or renamed so the stored data became unusable. One case showed a ransomware group placing the name of a recovery firm into compromised data, which illustrates why threat intelligence needs careful artifact filtering. The speaker then demonstrates two open tools built to scan remote databases: basic checks that enumerate contents for ransom indicators, and intrusive checks that pull more detail from infected instances. Honeypot detection for Elasticsearch scanning is also covered.

The closing takeaway is that no single control is enough. Practitioners should keep database interfaces off the public internet, maintain hardening baselines and patching, run regular posture assessments rather than one-off tests, add anomaly detection alongside signatures, and watch outbound connections for signs of data exfiltration. Security checks before cloud database instances are deployed are recommended as a standing policy.