Loading story…
Opportunistic, malware-less ransomware campaigns are targeting Internet-exposed database servers, including MySQL, Amazon Aurora MySQL, MariaDB, MongoDB, and PostgreSQL. Attackers exploit weak, default, or absent authentication to log in remotely, potentially exfiltrate records, delete or destroy the databases with legitimate administrative commands, and leave payment demands in newly created tables or collections rather than deploying file-encrypting malware.
MongoDB was the most frequently targeted platform in analyzed cloud incidents, followed by PostgreSQL, while reports also identify damaging attacks against MySQL servers. The operations may pair data destruction with double-extortion threats and can provide access for remote code execution or lateral movement. Organizations should remove public database exposure, enforce strong credentials and MFA-protected administration, maintain tested isolated backups, continuously identify exposed assets, and hunt databases for ransom-note artifacts.
Map this exposure pattern across your cloud, code, and identities.
3 events from the most recent confirmed update back to the earliest known activity.
Rapid7 researchers observed thousands of Internet-exposed databases being hijacked in bulk through automated attacks.
Threat actors conduct automated malware-less ransomware campaigns against Internet-facing database services with absent, default, or weak credentials. After authenticating through legitimate database protocols, they may destroy data, leave ransom-note tables or collections, and threaten to disclose allegedly exfiltrated data.
A Guardicore Labs (now Akamai) report described a campaign targeting MySQL servers in which attackers uploaded victim database dumps to a dark-web auction site to pressure victims into paying.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are running **large-scale, automated ransomware-style data destruction campaigns** against internet-exposed services, prioritizing speed and volume over complex intrusion. One active operation targets publicly accessible **MongoDB** instances by scanning for unauthenticated databases on `27017`, enumerating/exporting contents to gauge value, then dropping collections/databases and inserting ransom notes demanding **Bitcoin** payments (commonly **$500–$600**) with short deadlines (often ~48 hours). Reporting cited internet-wide exposure on the order of **200,000** MongoDB servers reachable online, with thousands lacking access controls; analysis of observed compromises suggested a significant portion of fully exposed instances already contain ransom notes, and most payments were linked to a **single Bitcoin wallet**, indicating a potentially centralized operator. Separately, a destructive ransomware campaign hit multiple **VPS providers** by exploiting a **critical vulnerability in the Virtualizor management panel ecosystem**, including its **WHMCS integration/plugin and API communications**, enabling attackers to execute unauthorized management-layer commands across nodes/VMs without typical indicators such as anomalous SSH logins. **CloudCone** confirmed customer disk data on affected nodes was **unrecoverable** and that it was rebuilding nodes from scratch; **HostSlick** and **OuiHeberg** were also named as impacted, with additional providers believed at risk due to shared use of the same management stack. The incidents underscore that exposed admin planes (database services and hosting control panels) can enable rapid, automated destruction and extortion even when traditional host-level access telemetry (e.g., SSH) shows little or no suspicious activity.
Jun 29, 2026
Threat actors are conducting a highly automated extortion campaign against **publicly exposed MongoDB instances**, exploiting **missing/weak authentication** and, in some cases, **outdated vulnerable versions** to gain access, wipe databases, and replace contents with ransom notes demanding cryptocurrency. Reporting indicates the activity is largely opportunistic and driven by internet-wide discovery (e.g., Shodan-style scanning), with little evidence of targeted intrusion or post-exploitation beyond **data destruction** and claimed exfiltration; victims are typically asked to pay to recover data, despite no reliable evidence that data is restored after payment. Findings cited from Flare’s research indicate the scale of exposure is significant: more than **200,000** MongoDB servers were publicly discoverable, with about **3,100** described as fully exposed without access restrictions; of those, **1,416 (45.6%)** were already compromised and wiped, with ransom demands commonly around **$500 in Bitcoin**. Wallet reuse strongly suggests centralization of the activity: only a handful of wallets were observed, with `bc1qe2l4ffmsqfdu43d7n76hp2ksmhclt5g9krx3du` appearing in **over 98%** of cases, consistent with a single dominant actor or closely coordinated group; the primary risk driver is **misconfiguration** rather than high-impact RCE, as many observed vulnerabilities were assessed as more likely to enable denial-of-service than full compromise on their own.
Jun 29, 2026
Attackers targeted externally exposed, unpatched **Microsoft SQL Server** systems by exploiting `CVE-2019-1068` and `CVE-2020-0618`, then delivered a mix of malware and ransomware through shared infrastructure and tooling. Sophos linked the intrusions through common ingress methods, command-and-control servers, PowerShell downloaders, a **.NET downloader**, **Remcos RAT**, the **Kill$** cleaner, and **7zip SFX**-based loaders, with ransomware payloads including **TargetCompany/Mallox** and **GlobeImposter/Alpha865qqz**. Most victims were observed in Asia, with additional cases in the Americas, and Chinese-language comments in some tools suggested the operators may be based in Asia. In one investigated case, the attackers returned after an earlier ransomware incident because the SQL Server remained unpatched, showing how exposed systems can be repeatedly compromised until the root weakness is fixed. Sophos said its defenses blocked follow-on payload delivery and prevented lateral movement, data exfiltration, and further ransom escalation, while responders also identified **IOBit Unlocker** as an attempted anti-security utility. Continued traffic to a fake **KMSAuto**-themed download site helped tie the customer incident to the wider campaign.
Aug 15, 2026