🔍 What’s happening?
Threat actors are running large-scale, fully automated ransomware campaigns against internet-exposed MongoDB instances.
Attackers scan for databases exposed on port 27017 with no authentication, wipe all collections, and leave ransom notes demanding $500–$600 in Bitcoin.
Key findings
- ⚙️ 45.6% of fully exposed MongoDB instances already contain ransom notes
- 💰 98% of ransom payments flow to a single Bitcoin wallet, pointing to a dominant operator
- 🌍 Over 200,000 MongoDB servers are internet-accessible
- 🔓 ~3,100 instances confirmed as fully exposed and unauthenticated
These attacks are not exploiting a MongoDB vulnerability — they rely entirely on deployment misconfigurations.
Why this works
- MongoDB bound to 0.0.0.0 with no auth
- Port 27017 exposed to the internet
- Insecure Docker images and copy-paste IaC templates
- Authentication never enabled in production
Once discovered, the attack is immediate and destructive.
Mitigation is urgent
- 🔒 Restrict MongoDB to private networks only
- 🔐 Enforce SCRAM authentication + RBAC
- 🚫 Block public access to port 27017
- 🧱 Replace insecure Docker images with hardened builds
- 👀 Continuously monitor exposure (e.g. Shodan / CSPM tools)
There may be no pre-auth RCE today — but one zero-day could instantly expose hundreds of thousands of servers.
➡️ Exposed MongoDB instances are being wiped and extorted at scale — enforcing private networking, authentication, and continuous exposure monitoring is now a baseline requirement, not a best practice.
