MySQL AES_ENCRYPT mass encryption followed by DROP TABLE and ransom note

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•2

Detects potential database ransomware activity by correlating the usage of AES_ENCRYPT for record modification, followed by the dropping of tables and the insertion of ransom notes containing specific contact keywords (e.g., bitcoin, proton mail) within database queries or system logs.