Panamorfi TCP flood DDoS Attack Targeting Jupyter Notebooks

An attacker, identified as Yawixooo, leveraged a publicly accessible Jupyter Notebook honeypot as an initial access vector.

The honeypot’s exposure to the internet-enabled Yawixooo to exploit it without requiring complex techniques. 

Once gaining a foothold on the system, the attacker downloaded a new zip file (MD5: 42989a405c8d7c9cb68c323ae9a9a318) from filebin.net, which was only flagged as malicious by ESET on VirusTotal and contained two JAR files.

Are you from SOC and DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Free Access

These JAR files were also new and only detected by ESET, indicating that they were likely obfuscated or otherwise evasive of traditional antivirus scanning.

The connector JAR file serves as a malicious payload, leveraging Discord as a command-and-control channel.

Upon execution, it downloads and executes the mineping JAR, a known DDoS tool, which initiates a TCP flood attack, overwhelming the target server with connection requests. 

Attack progress and results are communicated back to the threat actor via the Discord channel, facilitating remote control and monitoring of the DDoS operation. 

Threat actor ‘yawixooo’ is associated with the Panamorfi DDoS campaign.

The attack utilizes a Java-based tool named mineping.jar, which contains 12 files designed for HTTP socket loading, proxy usage, victim flooding, and random connection generation. 

This malicious package, likely repurposed from a Minecraft server tool, enables the launch of a distributed denial-of-service attack against targeted systems.  

The threat actor behind the incident has been identified as ‘yawixooo’, a GitHub user with an active public repository, which currently hosts a Minecraft server configuration and an under-construction HTML page. 

Investigators are actively examining the repository for potential indicators of compromise or additional malicious activity associated with the threat actor. 

Aqua’s CNAPP addresses the security risks associated with data practitioners using Jupyter notebooks by employing runtime protection to detect and block anomalous behavior, which complements traditional vulnerability management and misconfiguration remediation by providing a real-time defense against zero-day threats and unauthorized actions. 

Enforcing granular runtime policies prevents the execution of malicious payloads outside the Jupyter notebook scope, mitigating potential data breaches and maintaining system integrity. 

Aqua Nautilus researchers identified a novel DDoS campaign, “Panamorfi,” leveraging the Java-based Minecraft DDoS tool “mineping.” Threat actors deploy this attack exclusively through misconfigured Jupyter notebooks. 

The campaign targets systems with a DDoS, exploiting vulnerabilities in exposed notebooks. Organizations must prioritize securing Jupyter notebooks and implementing robust DDoS protection measures to mitigate this threat. 

How to Build a Security Framework With Limited Resources IT Security Team (PDF) - Free Guide