Wednesday, May 7, 2025
HomeCyber AttackPanamorfi TCP flood DDoS Attack Targeting Jupyter Notebooks

Panamorfi TCP flood DDoS Attack Targeting Jupyter Notebooks

Published on

SIEM as a Service

Follow Us on Google News

An attacker, identified as Yawixooo, leveraged a publicly accessible Jupyter Notebook honeypot as an initial access vector.

The honeypot’s exposure to the internet-enabled Yawixooo to exploit it without requiring complex techniques. 

Once gaining a foothold on the system, the attacker downloaded a new zip file (MD5: 42989a405c8d7c9cb68c323ae9a9a318) from filebin.net, which was only flagged as malicious by ESET on VirusTotal and contained two JAR files.

- Advertisement - Google News

Are you from SOC and DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Free Access

These JAR files were also new and only detected by ESET, indicating that they were likely obfuscated or otherwise evasive of traditional antivirus scanning.

The zip file with a single detection

The connector JAR file serves as a malicious payload, leveraging Discord as a command-and-control channel.

Upon execution, it downloads and executes the mineping JAR, a known DDoS tool, which initiates a TCP flood attack, overwhelming the target server with connection requests. 

Attack progress and results are communicated back to the threat actor via the Discord channel, facilitating remote control and monitoring of the DDoS operation. 

The function that updates the Discord channel

Threat actor ‘yawixooo’ is associated with the Panamorfi DDoS campaign.

The attack utilizes a Java-based tool named mineping.jar, which contains 12 files designed for HTTP socket loading, proxy usage, victim flooding, and random connection generation. 

This malicious package, likely repurposed from a Minecraft server tool, enables the launch of a distributed denial-of-service attack against targeted systems.  

The Panamorfi DDoS logo

The threat actor behind the incident has been identified as ‘yawixooo’, a GitHub user with an active public repository, which currently hosts a Minecraft server configuration and an under-construction HTML page. 

Investigators are actively examining the repository for potential indicators of compromise or additional malicious activity associated with the threat actor. 

The website of the threat actor is under construction

Aqua’s CNAPP addresses the security risks associated with data practitioners using Jupyter notebooks by employing runtime protection to detect and block anomalous behavior, which complements traditional vulnerability management and misconfiguration remediation by providing a real-time defense against zero-day threats and unauthorized actions. 

Enforcing granular runtime policies prevents the execution of malicious payloads outside the Jupyter notebook scope, mitigating potential data breaches and maintaining system integrity. 

Aqua Nautilus researchers identified a novel DDoS campaign, “Panamorfi,” leveraging the Java-based Minecraft DDoS tool “mineping.” Threat actors deploy this attack exclusively through misconfigured Jupyter notebooks. 

The campaign targets systems with a DDoS, exploiting vulnerabilities in exposed notebooks. Organizations must prioritize securing Jupyter notebooks and implementing robust DDoS protection measures to mitigate this threat. 

How to Build a Security Framework With Limited Resources IT Security Team (PDF) - Free Guide

Raga Varshini
Raga Varshini
Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Latest articles

Top Ransomware Groups Target Financial Sector, 406 Incidents Revealed

Flashpoint analysts have reported that between April 2024 and April 2025, the financial sector...

Agenda Ransomware Group Enhances Tactics with SmokeLoader and NETXLOADER

The Agenda ransomware group, also known as Qilin, has been reported to intensify its...

SpyCloud Analysis Reveals 94% of Fortune 50 Companies Have Employee Data Exposed in Phishing Attacks

SpyCloud, the leading identity threat protection company, today released an analysis of nearly 6...

PoC Tool Released to Detect Servers Affected by Critical Apache Parquet Vulnerability

F5 Labs has released a new proof-of-concept (PoC) tool designed to help organizations detect...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Healthcare Sector Becomes a Major Target for Cyber Attacks in 2025

The healthcare sector has emerged as a prime target for cyber attackers, driven by...

Popular Instagram Blogger’s Account Hacked to Phish Users and Steal Banking Credentials

A high-profile Russian Instagram blogger recently fell victim to a sophisticated cyberattack, where scammers...

Ransomware Attacks on Food & Agriculture Industry Surge 100% – 84 Attacks in Just 3 Months

The food and agriculture industry is facing an unprecedented wave of cybersecurity threats in...