Automated MongoDB Extortion Campaign Targeting Exposed Instances — Threadlinqs Intelligence
As of 2026-05-30, Automated MongoDB Extortion Campaign Targeting Exposed Instances is a high-severity ransomware threat attributed to crazzynoob (Multiple), tracked by Threadlinqs Intelligence with 23 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 70 indicators of compromise.
Threat ID: TL-2026-0006 · Severity: HIGH · CVSS: 7.5 · Status: ACTIVE · Category: RANSOMWARE
Attribution: crazzynoob · Multiple · FINANCIAL
Automated MongoDB extortion campaigns continue to exploit internet-facing MongoDB instances with default configurations (no authentication, bound to 0.0.0.0). As of February 2026, Shodan identifies
The MongoDB extortion campaign represents the most fundamental database security failure: production databases exposed to the internet without authentication. This is not a vulnerability exploitation — it is the absence of the most basic security control.
**The Attack Pipeline:**
1. **Scanning**: Automated tools scan internet-facing IP ranges on port 27017 (MongoDB default) and port 28017 (MongoDB HTTP interface). Shodan, Censys, and custom scanners identify targets. As of Feb 2026, Shodan shows 108,826+ exposed instances globally, with China (22,655), US (17,576), Germany (12,351), Hong Kong (6,640), and France (5,302) as the top exposed countries.
2. **Connection**: Attacker connects to exposed MongoDB instance without any credentials. No exploit needed — the instance has no authentication configured. The `mongo` shell or `pymongo` library connects directly.
3. **Exfiltration**: Before deletion, the attacker dumps the database contents. This data has secondary value: PII for identity theft, credentials for stuffing, business data for competitive intelligence, or bulk sale on darknet markets.
4. **Deletion**: All collections dropped. The database is wiped clean.
5. **Ransom Note**: A new collection (typically 'README' or 'WARNING') is inserted containing a ransom demand: send $500 in Bitcoin to a specified wallet address, email proof of payment to receive a data dump. The note threatens permanent deletion if payment is not received within 48 hours.
6. **Automation**: The entire pipeline is automated. The dominant actor 'crazzynoob' operates scripts that process hundreds of instances per day. No human interaction required after initial script deployment.
**The Dominant Actor — 'crazzynoob':**
Flare research and community analysis identified that approximately 98% of MongoDB extortion attacks originate from a single actor using the moniker 'crazzynoob'. Characteristics:
- Uses a small number of Bitcoin wallet addresses for ransom collection
- Consistent ransom amount ($500 USD equivalent in BTC)
- Identical ransom note template across all targets
- Automated scanning and exploitation pipeline
- No evidence of targeted selection — pure opportunistic automated scanning
- Active since at least 2017, with periodic campaign waves
- Payment rate estimated <5% — most victims either restore from backup or accept data loss
- Despite low payment rate, the campaign persists because automation makes per-target cost near zero
**Exposed Instance Landscape (Feb 2026):**
- **Total exposed (Shodan)**: 108,826+ MongoDB instances
- **Default port 27017**: 98,919 (91%)
- **Top hosting providers**: Aliyun/Alibaba Cloud (8,876), Hetzner (7,074), DigitalOcean (6,699), Google Cloud (4,072), Contabo (3,822)
- **Geographic distribution**: China 22,655, US 17,576, Germany 12,351, Hong Kong 6,640, France 5,302
- **Unauthenticated subset**: Estimated 3,100+ instances with no authentication (down from historical peaks due to MongoDB 3.6+ defaults)
- **Growth trend**: Despite improved defaults in MongoDB 4.x+, new deployments on cloud VPS continue to appear without authentication — developer convenience overrides security
**Why This Persists:**
1. **Default configuration gap**: MongoDB pre-3.6 shipped bound to 0.0.0.0 without authentication. Many legacy deployments persist.
2. **Cloud deployment pattern**: Developers spin up VPS instances, install MongoDB for quick prototyping, and never enable auth. The instance stays running indefinitely.
3. **Docker misconfigurations**: MongoDB containers often expose port 27017 to 0.0.0.0 via Docker port mapping without adding authentication.
4. **No immediate consequence**: An exposed MongoDB works perfectly for the developer — the security gap is invisible until the extortion hits.
5. **Automation economics**: The attacker's cost per target approaches zero. Even 1-2% payment rate is profitable.
**Data at Risk:**
Exposed MongoDB instances contain every type of data:
- Customer PII (names, emails, addresse
Weaknesses (CWE)
CWE-306, CWE-287, CWE-668
Target sectors: Technology, Healthcare, Education, Government, Financial Services, All Sectors
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 23 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 70 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RANSOMWARE, HIGH, threat intelligence, cybersecurity, T1595, T1595, T1596, T1583, T1588, T1190, T1133, T1059, T1078, T1046