Gootkit malware crew left their database exposed online without a password

guest · Sep 17, 2019

Gootkit malware crew left their database exposed online without a password
Even cyber-criminal gangs can't secure their MongoDB servers properly
September 17, 2019
https://www.zdnet.com/article/gootk...r-database-exposed-online-without-a-password/

Diachenko shared some of this data exclusively with ZDNet, and this article is a result of weeks of looking into samples of data the Gootkit gang gathered from infected hosts.

Nowadays, Gootkit's main functions are focused on stealing data from browsers. It can extract and exfiltrate data such as browsing history, passwords, and cookie files, and supports extracting this information from multiple browser types, from Chrome to Internet Explorer.
Furthermore, Gootkit can also log what users enter inside web forms. This doesn't only include passwords, but also payment card numbers.
TWO LEAKY MONGODB SERVERS
It is unclear if the Gootkit gang forgot to set a password, or if a firewall blocking access to these servers went down. However, something happened, and these servers became exposed, were indexed by various IoT search engines, and eventually discovered by Diachenko over the summer.
In the data we analyzed, we found credentials for all sorts of sites, from Polish ski shops to Envato marketplaces, and from Bulgarian government agencies to cryptocurrency exchanges.
Click to expand...

Log in or Sign up

Gootkit malware crew left their database exposed online without a password

guest Guest

Log in or Sign up

Gootkit malware crew left their database exposed online without a password

guest Guest

Useful Searches