Reported by 2 outlets

Timeline

1. update from cyberpress.org

   RAVEN Steals Entire Elasticsearch Databases and Rebuilds Backdoors After Defenders Delete Them

   cyberpress.org · 55d ago · August 19th, 2026

   A new demonstration involving the RAVEN Elasticsearch security-testing tool shows how a compromised cluster can lead to full data theft and long-term unauthorized access. The research highlights why exposed or poorly secured Elasticsearch deployments remain a serious enterprise risk. RAVEN can extract documents from individual Elasticsearch indices or export data from every non-system index. The stolen records are saved in NDJSON format, allowing attackers to search, parse, or import the data into another Elasticsearch environment. This turns an initial access issue into a direct business-impact event, an intruder could copy customer records, internal logs, orders, and other indexed information. The tool uses Elasticsearch pagination features to collect records in batches. It can also resume interrupted extraction jobs, reducing the impact of network failures during large data transfers. For defenders, this means unusual query volume, repeated pagination activity, or unexpected exports should be investigated promptly. Exfiltrated user data on the attacker’s filesystem with real document content visible (Source: levelblue) RAVEN also demonstrates snapshot-based theft. Instead of transferring large volumes of data through repeated queries, an attacker could register a repository and create a server-side snapshot. The snapshot may place a copy of selected indices on the target server’s filesystem, potentially making detection through network monitoring more difficult. RAVEN Rebu

2. update from gbhackers.com

   RAVEN Tool Steals Entire Elasticsearch Databases and Rebuilds Deleted Backdoors

   gbhackers.com · 55d ago · August 19th, 2026

   The RAVEN offensive framework can turn compromised Elasticsearch and Kibana environments into durable data-theft and persistence operations. RAVEN, short for Reconnaissance & Attack on Vulnerable Elasticsearch Nodes, is an open-source modular framework built to assess Elasticsearch and Kibana security posture across reconnaissance, exploitation, exfiltration, persistence, and cleanup workflows. Its latest walkthrough focuses on post-exploitation against […] The post RAVEN Tool Steals Entire Elasticsearch Databases and Rebuilds Deleted Backdoors appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .