The MySQL database servers run by countless organizations may soon turn into weapons for launching DDoS attacks if they become infected with the Chikdos malware, security experts warn.

A Trojan first discovered two years ago by Polish cybersecurity officials, Chikdos malware was recently spotted in several countries where cybercriminals were using it for distributed denial-of-service (DDoS) attacks, according to Symantec. The attackers’ technique involves compromising the MySQL database engine’s user-defined function (UDF) capability. Once cybercriminals manage to inject malicious UDF code, they can execute as a library file and turn server bandwidth into a dangerous tool.

Although Chikdos has been used in systems running the open source Linux operating system in the past, iTWire said attackers are focusing on Windows MySQL databases. Most of the incidents tracked so far take place in the Netherlands, India, Brazil and China, but at least one of the DDoS attacks was aimed at a hosting provider based in the U.S.

To some extent, MySQL databases are a natural target for those using the Chikdos malware, suggested SecurityWeek. Available via open source and widely used by many organizations, MySQL has some pre-existing vulnerabilities that may make it easier to pull off DDoS attacks. The campaign appears to be ongoing, though hopefully as news spreads more CISOs and their teams will be able to contain it.

Unlike traditional desktops, MySQL servers have lots of bandwidth, which is one of the key ingredients for anyone interested in launching DDoS attacks, Computerworld pointed out. The best way to avoid becoming a victim is to make sure administrative privileges for all such systems are completely locked down and best practices are followed to avoid SQL injection attacks.

As a starting point, those running MySQL databases should start looking for any signs of the Chikdos malware by checking folders such as \Lib\, \Lib\plugin\ and \Bin\, Softpedia reported. If you see any randomly named .dll files that look at all suspicious, you may have already been compromised by cybercriminals using the Trojan. Unless you act quickly, the next wave of DDoS attacks may not be far behind.