Adrian Johnson
TLDR:
- Cybersecurity researchers have disclosed details of a new DDoS attack campaign targeting misconfigured Jupyter Notebooks.
- The attack utilizes a Java-based tool called mineping to launch a TCP flood DDoS attack.
Cybersecurity researchers have uncovered a new distributed denial-of-service (DDoS) attack campaign named Panamorfi that targets misconfigured Jupyter Notebooks. The attack involves using a Java-based tool called mineping to launch a TCP flood DDoS attack against the target server. The attackers exploit internet-exposed Jupyter Notebook instances to run wget commands for fetching a ZIP archive containing Java archive (JAR) files conn.jar and mineping.jar. These files are used to establish connections to a Discord channel and trigger the execution of the mineping.jar package, which aims to consume the resources of the target server by sending a large number of TCP connection requests. The attack is attributed to a threat actor named yawixooo, who has a public repository on GitHub containing a Minecraft server properties file.
This campaign is not the first time Jupyter Notebooks have been targeted by adversaries. In a previous incident in October 2023, a threat actor known as Qubitstrike breached Jupyter Notebooks to mine cryptocurrency and breach cloud environments. Organizations are advised to ensure the proper configuration of their Jupyter Notebooks and implement robust cybersecurity measures to defend against such attacks.
