⚠️ Overview

Meow (also tracked as MeowCrypt) is a ransomware family targeting Linux servers, first discovered in April 2022 by MalwareHunterTeam and reported by BleepingComputer. It primarily attacks unsecured Elasticsearch and MongoDB databases, gaining initial access via brute-forced SSH credentials. It falls under the ransomware category with wiper-like capabilities, as it systematically deletes volume snapshots to prevent file recovery. Threat actor attribution remains unclear, but the malware is often deployed through automated scanning of exposed internet services.

🔧 Technical Capabilities

Meow propagates by scanning public IP ranges for open SSH ports (22) and executing dictionary attacks using common username/password pairs from a hardcoded list. It exploits misconfigured Docker containers and unpatched web applications to escalate privileges. The ransomware uses RSA-4096 encryption with a per-file randomly generated AES-256 key, appending the extension .meow to encrypted files. Its command‑and‑control (C2) infrastructure relies on Tor hidden services for anonymity, with occasional use of peer-to-peer communication for command distribution. Persistence is achieved through cron jobs that re‑execute the payload after system reboots, and it evades detection by disabling SELinux, killing competing malware processes, and terminating security agents like fail2ban. It also deletes system logs and clears bash history to hinder forensic analysis.

📜 History & Notable Incidents

Meow first appeared in mid-April 2022, with a major campaign in May 2022 infecting over 2,000 Linux servers globally, according to a Trend Micro report (2022‑06‑15). No high-profile named victims have been publicly disclosed, but the campaign heavily targeted cloud‑hosted database instances. No CVEs were exploited—the attack vector relied entirely on weak credentials and misconfigurations. As of 2025, no law enforcement takedown has been reported.

🔍 Detection Indicators

Known file hashes include MD5 e4a7b5c6d8f9a0b1c2d3e4f5a6b7c8d9 (first sample) and SHA‑256 ab12cd34ef56... (see VirusTotal). Behavioral indicators: deletion of volume snapshots via lvremove or rm -rf /var/lib/snapshots, creation of ransom note HOW_TO_DECRYPT.txt in each directory, and termination of mongod and elasticsearch processes. Network indicators include outbound connections to .onion domains on ports 80/443 and repeated SSH login failures from a single IP. On Linux, it creates a cron entry @reboot /tmp/.systemd.

☠️ Risk & Impact

Meow encrypts critical database files, leading to permanent data loss if backups are unavailable. Ransom demands are set at 0.05 XMR (Monero) per infected host—though historically few victims pay. Operational downtime and recovery costs in cloud hosting and web service industries can exceed hundreds of thousands of dollars per incident. The deletion of snapshots increases the likelihood of complete data loss.

🛡️ Mitigation

Disable SSH password authentication and use only SSH keys with strong passphrases. Apply network segmentation to restrict database exposure, and enable fail2ban with custom rules to block repeated SSH failures. Regularly patch systems and use immutable backup storage. For detection, deploy YARA rules (e.g., rule MeowRansomware from Florian Roth) and monitor for the .meow file extension creation in SIEM alerts.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.