Hackers Target MongoDB Instances to Delete Databases and Plant Ransom Notes

Cybersecurity: MongoDB Ransomware Campaign

A comprehensive ransomware campaign is exploiting unsecured MongoDB databases worldwide. These databases are targeted due to their exposure to the internet without essential authentication measures.

Attackers utilize automated scripts to delete database contents and demand Bitcoin payments, capitalizing on configuration oversights to execute a wide-reaching extortion scheme.

Revival of a Past Threat

Previously active between 2017 and 2021, MongoDB ransomware attacks had affected numerous organizations globally. Although public reporting dwindled in subsequent years, recent findings indicate the threat remains prevalent.

In late 2025, researchers set up honeypot servers with exposed MongoDB instances lacking authentication. These servers rapidly received ransom demands for approximately $500 USD in Bitcoin, verifying the ongoing and automated nature of the attacks.

The re-emergence of this threat was further confirmed by penetration testing efforts, which discovered compromised MongoDB instances at a small-to-medium-sized enterprise.

The attack method leverages a critical vulnerability: internet-exposed databases without authentication. Attackers employ automated scanning to find MongoDB services on port 27017 that are accessible from any IP address, following a straightforward four-step process.

Process of Attack

• Identify vulnerable MongoDB instances via mass internet scanning.
• Export or copy database contents to attacker systems.
• Delete all collections and databases on the victim server.
• Insert a new collection with a ransom note demanding Bitcoin within 48 hours, threatening data loss if unpaid.

Security experts advise against paying ransoms, as victims often do not receive any recovery assistance, and attackers typically do not retain data copies.

Exposure and Vulnerability

Analysis using Shodan identified over 200,000 publicly accessible MongoDB servers. Of these, more than 3,100 lacked any access restrictions or authentication. Among these exposed servers, 1,416 have been compromised, with databases wiped and ransom notes inserted.

The attack campaign primarily utilizes a single Bitcoin wallet address, indicating the potential involvement of a dominant threat actor.

Efforts to investigate the threat landscape revealed many insecure deployment practices in tutorials, container images, and infrastructure templates. Additionally, active MongoDB ransom tutorials circulate on dark web forums, emphasizing the ease of executing such attacks without technical expertise.

Technical Mapping

The MongoDB ransomware campaign aligns with the MITRE ATT&CK framework, illustrating a full attack lifecycle:

• Initial Access: Exploit public-facing application by connecting to exposed MongoDB without authentication.
• Discovery: Use network service discovery to scan IP ranges for open MongoDB port 27017.
• Collection: Extract data from information repositories by dumping databases.
• Impact: Perform data destruction and service disruption by wiping databases and inserting ransom notes.

Despite its simplicity, the attack requires no privilege escalation or malware deployment, operating within permissions granted by insecure default configurations. This complicates detection and encourages reactive rather than proactive responses.