Secureworks Counter Threat Unit (CTU) researchers have identified indexes of multiple unsecured internet-facing Elasticsearch databases replaced with a ransom note. The note demands a Bitcoin payment in exchange for the data.