Panamorfi TCP flood DDoS Attack Targeting Jupyter Notebooks

An attacker, identified as Yawixooo, leveraged a publicly accessible Jupyter Notebook honeypot as an initial access vector.

The honeypot’s exposure to the internet-enabled Yawixooo to exploit it without requiring complex techniques. 

Once gaining a foothold on the system, the attacker downloaded a new zip file (MD5: 42989a405c8d7c9cb68c323ae9a9a318) from filebin.net, which was only flagged as malicious by ESET on VirusTotal and contained two JAR files.

Are you from SOC and DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Free Access

These JAR files were also new and only detected by ESET, indicating that they were likely obfuscated or otherwise evasive of traditional antivirus scanning.

The zip file with a single detection

The connector JAR file serves as a malicious payload, leveraging Discord as a command-and-control channel.

Upon execution, it downloads and executes the mineping JAR, a known DDoS tool, which initiates a TCP flood attack, overwhelming the target server with connection requests. 

Attack progress and results are communicated back to the threat actor via the Discord channel, facilitating remote control and monitoring of the DDoS operation. 

The function that updates the Discord channel

Threat actor ‘yawixooo’ is associated with the Panamorfi DDoS campaign.

The attack utilizes a Java-based tool named mineping.jar, which contains 12 files designed for HTTP socket loading, proxy usage, victim flooding, and random connection generation. 

This malicious package, likely repurposed from a Minecraft server tool, enables the launch of a distributed denial-of-service attack against targeted systems.  

The Panamorfi DDoS logo

The threat actor behind the incident has been identified as ‘yawixooo’, a GitHub user with an active public repository, which currently hosts a Minecraft server configuration and an under-construction HTML page. 

Investigators are actively examining the repository for potential indicators of compromise or additional malicious activity associated with the threat actor. 

The website of the threat actor is under construction

Aqua’s CNAPP addresses the security risks associated with data practitioners using Jupyter notebooks by employing runtime protection to detect and block anomalous behavior, which complements traditional vulnerability management and misconfiguration remediation by providing a real-time defense against zero-day threats and unauthorized actions. 

Enforcing granular runtime policies prevents the execution of malicious payloads outside the Jupyter notebook scope, mitigating potential data breaches and maintaining system integrity. 

Aqua Nautilus researchers identified a novel DDoS campaign, “Panamorfi,” leveraging the Java-based Minecraft DDoS tool “mineping.” Threat actors deploy this attack exclusively through misconfigured Jupyter notebooks. 

The campaign targets systems with a DDoS, exploiting vulnerabilities in exposed notebooks. Organizations must prioritize securing Jupyter notebooks and implementing robust DDoS protection measures to mitigate this threat. 

How to Build a Security Framework With Limited Resources IT Security Team (PDF) - Free Guide

Raga Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

Indonesia Government Data Breach – Hackers Leaked 82 GB of Sensitive Data Online

Hackers have reportedly infiltrated and extracted a vast 82 GB of sensitive data from the Indonesian…

1 hour ago

IBM AIX TCP/IP Vulnerability Lets Attackers Exploit to Launch Denial of Service Attack

IBM has issued a security bulletin warning of two vulnerabilities in its AIX operating system…

3 hours ago

Apache Auth-Bypass Vulnerability Lets Attackers Gain Control Over HugeGraph-Server

The Apache Software Foundation has issued a security alert regarding a critical vulnerability in Apache…

3 hours ago

USA Launched Cyber Attack on Chinese Technology Firms

The Chinese National Internet Emergency Center (CNIE) has revealed two significant cases of cyber espionage…

3 hours ago

Node.js systeminformation Package Vulnerability Exposes Millions of Systems to RCE Attacks

A critical command injection vulnerability in the popular systeminformation npm package has recently been disclosed, exposing millions…

2 days ago

Skuld Malware Using Weaponized Windows Utilities Packages To Deliver Malware

Researchers discovered a malware campaign targeting the npm ecosystem, distributing the Skuld info stealer through…

2 days ago