Loading story…
Threat actors are running large-scale, automated ransomware-style data destruction campaigns against internet-exposed services, prioritizing speed and volume over complex intrusion. One active operation targets publicly accessible MongoDB instances by scanning for unauthenticated databases on 27017, enumerating/exporting contents to gauge value, then dropping collections/databases and inserting ransom notes demanding Bitcoin payments (commonly $500–$600) with short deadlines (often ~48 hours). Reporting cited internet-wide exposure on the order of 200,000 MongoDB servers reachable online, with thousands lacking access controls; analysis of observed compromises suggested a significant portion of fully exposed instances already contain ransom notes, and most payments were linked to a single Bitcoin wallet, indicating a potentially centralized operator.
Separately, a destructive ransomware campaign hit multiple VPS providers by exploiting a critical vulnerability in the Virtualizor management panel ecosystem, including its WHMCS integration/plugin and API communications, enabling attackers to execute unauthorized management-layer commands across nodes/VMs without typical indicators such as anomalous SSH logins. CloudCone confirmed customer disk data on affected nodes was unrecoverable and that it was rebuilding nodes from scratch; HostSlick and OuiHeberg were also named as impacted, with additional providers believed at risk due to shared use of the same management stack. The incidents underscore that exposed admin planes (database services and hosting control panels) can enable rapid, automated destruction and extortion even when traditional host-level access telemetry (e.g., SSH) shows little or no suspicious activity.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Flare researchers reported that the MongoDB extortion activity was still ongoing, though at a smaller scale than the pre-2021 wave, and found that about 45.6% of roughly 3,100 unauthenticated exposed MongoDB servers had already been wiped and left with ransom notes. They also observed over 208,500 publicly exposed MongoDB servers and found wallet reuse patterns indicating one dominant actor behind most attacks.
Threat actors began conducting automated attacks against publicly exposed MongoDB instances that allowed unrestricted access, wiping or deleting data and leaving ransom notes demanding roughly 0.005 BTC within 48 hours. The activity primarily affected servers exposed on port 27017 without authentication and was driven by deployment misconfiguration rather than a MongoDB software flaw.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecyberkendra.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are conducting a highly automated extortion campaign against **publicly exposed MongoDB instances**, exploiting **missing/weak authentication** and, in some cases, **outdated vulnerable versions** to gain access, wipe databases, and replace contents with ransom notes demanding cryptocurrency. Reporting indicates the activity is largely opportunistic and driven by internet-wide discovery (e.g., Shodan-style scanning), with little evidence of targeted intrusion or post-exploitation beyond **data destruction** and claimed exfiltration; victims are typically asked to pay to recover data, despite no reliable evidence that data is restored after payment. Findings cited from Flare’s research indicate the scale of exposure is significant: more than **200,000** MongoDB servers were publicly discoverable, with about **3,100** described as fully exposed without access restrictions; of those, **1,416 (45.6%)** were already compromised and wiped, with ransom demands commonly around **$500 in Bitcoin**. Wallet reuse strongly suggests centralization of the activity: only a handful of wallets were observed, with `bc1qe2l4ffmsqfdu43d7n76hp2ksmhclt5g9krx3du` appearing in **over 98%** of cases, consistent with a single dominant actor or closely coordinated group; the primary risk driver is **misconfiguration** rather than high-impact RCE, as many observed vulnerabilities were assessed as more likely to enable denial-of-service than full compromise on their own.
Jun 29, 2026
Opportunistic, malware-less ransomware campaigns are targeting Internet-exposed database servers, including **MySQL**, Amazon Aurora MySQL, MariaDB, MongoDB, and PostgreSQL. Attackers exploit weak, default, or absent authentication to log in remotely, potentially exfiltrate records, delete or destroy the databases with legitimate administrative commands, and leave payment demands in newly created tables or collections rather than deploying file-encrypting malware. MongoDB was the most frequently targeted platform in analyzed cloud incidents, followed by PostgreSQL, while reports also identify damaging attacks against MySQL servers. The operations may pair data destruction with double-extortion threats and can provide access for remote code execution or lateral movement. Organizations should remove public database exposure, enforce strong credentials and MFA-protected administration, maintain tested isolated backups, continuously identify exposed assets, and hunt databases for ransom-note artifacts.
Sep 3, 2026
Attackers rapidly weaponized the critical cPanel and WHM authentication-bypass flaw **`CVE-2026-41940`** to seize control of exposed hosting servers, with researchers and internet telemetry providers reporting exploitation within a day of disclosure and signs the bug may have been abused earlier. The vulnerability affects cPanel/WHM deployments after 11.40, and reporting tied the surge to a sharp rise in maliciously flagged cPanel hosts, widespread scanning from tens of thousands of IPs, and compromises across a large internet-facing footprint that some estimates placed in the hundreds of thousands to more than a million systems. Post-compromise activity included **Sorry ransomware** encrypting files with the `.sorry` extension, Mirai-related botnet deployment, cryptomining, and website hijacking, prompting CISA to add the flaw to its Known Exploited Vulnerabilities catalog and order federal agencies to patch. Separate investigations found the flaw was also used in targeted intrusions against government, military, MSP, and hosting-provider networks, especially in Southeast Asia, while QiAnXin XLab linked a major campaign to a long-running actor it tracks as **Mr_Rot13**. In that activity, attackers used automated exploitation from more than 2,000 source IPs to install SSH persistence, change root credentials, drop PHP web shells, inject fake cPanel login pages to steal credentials, exfiltrate data to attacker infrastructure and Telegram, and deploy the cross-platform **Filemanager** backdoor for remote command execution. Researchers also reported follow-on use of AdaptixC2, OpenVPN, Ligolo, and custom persistence tooling, as well as theft of about **4.37 GB** of sensitive data, underscoring that the bug enabled both broad opportunistic compromise and more deliberate espionage-style operations.
Aug 15, 2026