New Meow bot attacks open ElasticSearch instances

A new automated malware is currently scanning for internet-connected ElasticSearch databases without access controls and overwriting the content in them, an independent security researcher has warned.

Bob Diachenko, who specialises in data breach research, had been looking into virtual network providers leaking log files when he discovered that in one such case, the Meow bot had overwritten information stored in an open ElasticSearch instance.

Unlike past attacks on open databases with ransomware that would encrypt files, the new bot simply destroys indexes by inserting random characters followed by "meow".

"It started a couple of days ago, and is now spreading fast," Diachenko told iTnews.

"No ransom, no threats, just destruction of clusters," Diachenko added.

In some cases however, the Meow bot does not destroy database indices, he said.

Diachenko said that there is currently no indication as to who is behind the Meow bot, or where it originated from.

In 2017, tens of thousands of MongoDB and ElasticSearch instances were attacked by a threat actor using the moniker Krakeno, causing widespread loss of data.

A Shodan.io scan by Diachenko showed over 500 open ElasticSearch instances worldwide, hosted on Amazon Web Services, Microsoft Azure, Google Cloud, Digital Ocean and OVH SAS.

Of the open ElasticSearch instances, five were hosted in Australia.