CTI · corroborated · 2026-08-19

RAVEN Tool Steals Entire Elasticsearch Databases and Rebuilds Deleted Backdoors

Full story & timeline

MITRE ATT&CK

• T1595 Active Scanning Reconnaissance
• T1190 Exploit Public-Facing Application Initial Access
• T1078 Valid Accounts Stealth
• T1505 Server Software Component Persistence
• T1213 Data from Information Repositories Collection
• T1020 Automated Exfiltration Exfiltration
• T1030 Data Transfer Size Limits Exfiltration

Indicators

No curated indicators tied to this case.

Detections

No detection content yet — case analysis did not yield signal-specific telemetry. Check back after the next daily CTI pass.

References

• https://gbhackers.com/elasticsearch-databases-theft/
• https://cyberpress.org/raven-rebuilds-elasticsearch-backdoors/