Loading story…
Threat actors are conducting a highly automated extortion campaign against publicly exposed MongoDB instances, exploiting missing/weak authentication and, in some cases, outdated vulnerable versions to gain access, wipe databases, and replace contents with ransom notes demanding cryptocurrency. Reporting indicates the activity is largely opportunistic and driven by internet-wide discovery (e.g., Shodan-style scanning), with little evidence of targeted intrusion or post-exploitation beyond data destruction and claimed exfiltration; victims are typically asked to pay to recover data, despite no reliable evidence that data is restored after payment.
Findings cited from Flare’s research indicate the scale of exposure is significant: more than 200,000 MongoDB servers were publicly discoverable, with about 3,100 described as fully exposed without access restrictions; of those, 1,416 (45.6%) were already compromised and wiped, with ransom demands commonly around $500 in Bitcoin. Wallet reuse strongly suggests centralization of the activity: only a handful of wallets were observed, with bc1qe2l4ffmsqfdu43d7n76hp2ksmhclt5g9krx3du appearing in over 98% of cases, consistent with a single dominant actor or closely coordinated group; the primary risk driver is misconfiguration rather than high-impact RCE, as many observed vulnerabilities were assessed as more likely to enable denial-of-service than full compromise on their own.
Map this exposure pattern across your cloud, code, and identities.
4 events from the most recent confirmed update back to the earliest known activity.
Reporting cited in the references said attackers were also exploiting MongoBleed (CVE-2025-14847) against affected MongoDB version ranges in real-world attacks, alongside attention to CVE-2024-3372. The coverage emphasized that vulnerability exploitation was secondary to the larger problem of exposed and unauthenticated deployments.
Analysis found the same Bitcoin wallet in the vast majority of incidents, including one report that said a single wallet appeared in 98% of observed cases. This wallet reuse suggested that one dominant threat actor or a closely coordinated group was responsible for most of the extortion activity.
Flare reported that among 3,100 fully exposed MongoDB servers without access restrictions, 1,416 had already been compromised and wiped, a 45.6% compromise rate. The firm also noted that while more than 200,000 MongoDB servers were publicly discoverable, misconfiguration and missing access controls were the primary drivers of the attacks.
Attackers began systematically scanning for internet-exposed MongoDB instances with missing authentication, accessing them without credentials, and wiping or overwriting databases before leaving Bitcoin ransom notes. The activity was characterized as opportunistic and highly automated, with no credible evidence that payment restores data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are running **large-scale, automated ransomware-style data destruction campaigns** against internet-exposed services, prioritizing speed and volume over complex intrusion. One active operation targets publicly accessible **MongoDB** instances by scanning for unauthenticated databases on `27017`, enumerating/exporting contents to gauge value, then dropping collections/databases and inserting ransom notes demanding **Bitcoin** payments (commonly **$500–$600**) with short deadlines (often ~48 hours). Reporting cited internet-wide exposure on the order of **200,000** MongoDB servers reachable online, with thousands lacking access controls; analysis of observed compromises suggested a significant portion of fully exposed instances already contain ransom notes, and most payments were linked to a **single Bitcoin wallet**, indicating a potentially centralized operator. Separately, a destructive ransomware campaign hit multiple **VPS providers** by exploiting a **critical vulnerability in the Virtualizor management panel ecosystem**, including its **WHMCS integration/plugin and API communications**, enabling attackers to execute unauthorized management-layer commands across nodes/VMs without typical indicators such as anomalous SSH logins. **CloudCone** confirmed customer disk data on affected nodes was **unrecoverable** and that it was rebuilding nodes from scratch; **HostSlick** and **OuiHeberg** were also named as impacted, with additional providers believed at risk due to shared use of the same management stack. The incidents underscore that exposed admin planes (database services and hosting control panels) can enable rapid, automated destruction and extortion even when traditional host-level access telemetry (e.g., SSH) shows little or no suspicious activity.
Jun 29, 2026
Opportunistic, malware-less ransomware campaigns are targeting Internet-exposed database servers, including **MySQL**, Amazon Aurora MySQL, MariaDB, MongoDB, and PostgreSQL. Attackers exploit weak, default, or absent authentication to log in remotely, potentially exfiltrate records, delete or destroy the databases with legitimate administrative commands, and leave payment demands in newly created tables or collections rather than deploying file-encrypting malware. MongoDB was the most frequently targeted platform in analyzed cloud incidents, followed by PostgreSQL, while reports also identify damaging attacks against MySQL servers. The operations may pair data destruction with double-extortion threats and can provide access for remote code execution or lateral movement. Organizations should remove public database exposure, enforce strong credentials and MFA-protected administration, maintain tested isolated backups, continuously identify exposed assets, and hunt databases for ransom-note artifacts.
Sep 3, 2026
A critical vulnerability, CVE-2025-14847, known as MongoBleed, has been discovered in MongoDB, allowing unauthenticated remote attackers to read uninitialized heap memory from affected servers when zlib compression is enabled. This flaw exposes sensitive in-memory data such as credentials, session tokens, and application secrets, and is present across a wide range of MongoDB versions. The vulnerability is actively being exploited, with CISA adding it to the Known Exploited Vulnerabilities (KEV) catalog and warning that over 80,000 servers are at risk. The attack requires no authentication or user interaction, making it a high-severity issue for organizations using MongoDB in cloud, SaaS, and enterprise environments. The MongoBleed vulnerability has reportedly been linked to a major breach in Ubisoft's Rainbow Six Siege, where attackers exploited the flaw to manipulate in-game assets, resulting in the unauthorized distribution of billions of in-game credits and random moderation actions. Ubisoft responded by shutting down game servers and rolling back transactions, though the company has not officially confirmed MongoBleed as the root cause. The incident highlights the real-world impact of MongoDB vulnerabilities on high-profile applications and underscores the urgent need for organizations to apply mitigations and monitor for exploitation attempts.
Jun 29, 2026