AppWizard
August 5, 2024
A new cyber threat campaign called "Panamorfi," orchestrated by the actor yawixooo, targets misconfigured publicly accessible Jupyter notebooks. The attackers use a Minecraft server DDoS tool distributed via Discord to overwhelm servers. The attack begins with yawixooo accessing exposed Jupyter notebooks and executing a command to download a zip file containing two Jar files: conn.jar and mineping.jar. The conn.jar file is crucial for executing the attack, utilizing Discord to manage the DDoS operation and loading mineping.jar, which is designed for TCP flood attacks. Researchers disrupted the attack by preventing the execution of conn.jar and recommend securing Jupyter notebooks, blocking specific file executions, limiting code execution capabilities, and applying security updates. Security professionals warn against sharing sensitive information in Jupyter notebooks.
