Sunday, May 25, 2025
HomeCyber AttackPanamorfi TCP flood DDoS Attack Targeting Jupyter Notebooks

Panamorfi TCP flood DDoS Attack Targeting Jupyter Notebooks

Published on

SIEM as a Service

Follow Us on Google News

An attacker, identified as Yawixooo, leveraged a publicly accessible Jupyter Notebook honeypot as an initial access vector.

The honeypot’s exposure to the internet-enabled Yawixooo to exploit it without requiring complex techniques. 

Once gaining a foothold on the system, the attacker downloaded a new zip file (MD5: 42989a405c8d7c9cb68c323ae9a9a318) from filebin.net, which was only flagged as malicious by ESET on VirusTotal and contained two JAR files.

- Advertisement - Google News

Are you from SOC and DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Free Access

These JAR files were also new and only detected by ESET, indicating that they were likely obfuscated or otherwise evasive of traditional antivirus scanning.

The zip file with a single detection

The connector JAR file serves as a malicious payload, leveraging Discord as a command-and-control channel.

Upon execution, it downloads and executes the mineping JAR, a known DDoS tool, which initiates a TCP flood attack, overwhelming the target server with connection requests. 

Attack progress and results are communicated back to the threat actor via the Discord channel, facilitating remote control and monitoring of the DDoS operation. 

The function that updates the Discord channel

Threat actor ‘yawixooo’ is associated with the Panamorfi DDoS campaign.

The attack utilizes a Java-based tool named mineping.jar, which contains 12 files designed for HTTP socket loading, proxy usage, victim flooding, and random connection generation. 

This malicious package, likely repurposed from a Minecraft server tool, enables the launch of a distributed denial-of-service attack against targeted systems.  

The Panamorfi DDoS logo

The threat actor behind the incident has been identified as ‘yawixooo’, a GitHub user with an active public repository, which currently hosts a Minecraft server configuration and an under-construction HTML page. 

Investigators are actively examining the repository for potential indicators of compromise or additional malicious activity associated with the threat actor. 

The website of the threat actor is under construction

Aqua’s CNAPP addresses the security risks associated with data practitioners using Jupyter notebooks by employing runtime protection to detect and block anomalous behavior, which complements traditional vulnerability management and misconfiguration remediation by providing a real-time defense against zero-day threats and unauthorized actions. 

Enforcing granular runtime policies prevents the execution of malicious payloads outside the Jupyter notebook scope, mitigating potential data breaches and maintaining system integrity. 

Aqua Nautilus researchers identified a novel DDoS campaign, “Panamorfi,” leveraging the Java-based Minecraft DDoS tool “mineping.” Threat actors deploy this attack exclusively through misconfigured Jupyter notebooks. 

The campaign targets systems with a DDoS, exploiting vulnerabilities in exposed notebooks. Organizations must prioritize securing Jupyter notebooks and implementing robust DDoS protection measures to mitigate this threat. 

How to Build a Security Framework With Limited Resources IT Security Team (PDF) - Free Guide

Raga Varshini
Raga Varshini
Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Latest articles

Zero-Trust Policy Bypass Enables Exploitation of Vulnerabilities and Manipulation of NHI Secrets

A new project has exposed a critical attack vector that exploits protocol vulnerabilities to...

Threat Actor Sells Burger King Backup System RCE Vulnerability for $4,000

A threat actor known as #LongNight has reportedly put up for sale remote code...

Chinese Nexus Hackers Exploit Ivanti Endpoint Manager Mobile Vulnerability

Ivanti disclosed two critical vulnerabilities, identified as CVE-2025-4427 and CVE-2025-4428, affecting Ivanti Endpoint Manager...

Hackers Target macOS Users with Fake Ledger Apps to Deploy Malware

Hackers are increasingly targeting macOS users with malicious clones of Ledger Live, the popular...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

EU Targets Stark Industries in Cyberattack Sanctions Crackdown

The European Union has escalated its response to Russia’s ongoing campaign of hybrid threats,...

Venice.ai’s Unrestricted Access Sparks Concerns Over AI-Driven Cyber Threats

Venice.ai has rapidly emerged as a disruptive force in the AI landscape, positioning itself...

TAG-110 Hackers Deploy Malicious Word Templates in Targeted Attacks

The Russia-aligned threat actor TAG-110, also linked to UAC-0063 and APT28 (BlueDelta) with medium...