MongoDB Data Extortion Campaign - 1,400+ Databases Ransacked — Threadlinqs Intelligence
As of 2026-05-30, MongoDB Data Extortion Campaign - 1,400+ Databases Ransacked is a high-severity extortion threat attributed to a Russia-nexus actor, tracked by Threadlinqs Intelligence with 13 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 47 indicators of compromise.
Threat ID: TL-2026-0023 · Severity: HIGH · CVSS: 8.6 · Status: ACTIVE · Category: EXTORTION
Attribution: Russia · FINANCIAL
Automated MongoDB data extortion campaigns have ransacked 1,400+ databases in single waves, operated by competing actor groups (Harak1r1, Kraken0, Cru3lty, Unistellar, m0ng0d4t4b4s3) who run
The MongoDB extortion ecosystem represents the most efficient cybercrime operation per unit of effort in history. Unlike ransomware (which requires malware development, delivery mechanisms, encryption, and decryption infrastructure), MongoDB extortion requires only: (1) a Shodan API key or Masscan installation, (2) a MongoDB client (mongosh/mongo), (3) a Bitcoin wallet, and (4) a simple script.
The automated extortion pipeline:
STEP 1 — DISCOVERY: Attackers enumerate internet-facing MongoDB instances on port 27017 using Shodan, Censys, or Masscan. Shodan query: 'product:MongoDB port:27017' returns tens of thousands of results. Each result includes IP, port, version, and sometimes database names — enough to assess target value before connecting.
STEP 2 — RECONNAISSANCE: The script connects to each target without authentication (MongoDB's pre-4.0 default bound to 0.0.0.0 with no auth). The attacker runs 'show dbs' to enumerate databases, 'db.stats()' to assess size, and collection names to gauge value (databases named 'production', 'customers', 'orders', 'users' are high-value targets).
STEP 3 — EXFILTRATION (OR NOT): Here lies the fundamental deception. SOME operators export the data via mongodump before wiping (enabling actual data return on ransom payment). MOST operators skip this step entirely — the data volume is too large to store economically, and storing victim data creates legal risk. They simply proceed to deletion.
STEP 4 — DESTRUCTION: The script drops all user-created databases and collections. This takes seconds via 'db.dropDatabase()' for each database. Years of data destroyed in a single API call.
STEP 5 — RANSOM NOTE: A new database (often named 'README', 'WARNING', 'PLEASE_READ', 'RECOVER_YOUR_DATA') is created containing a single document with: a Bitcoin address, a ransom amount ($200-$1,000 in BTC), an email address for 'negotiation', and a deadline (typically 48 hours). Example note: 'All your data is backed up. You must pay 0.015 BTC to [address] to recover it. Email: [address]. Deadline: 48 hours or data is deleted permanently.'
STEP 6 — COLLECTION: Victims who pay receive nothing (data was never backed up) or receive a partial dump. Bitcoin addresses are monitored for payments. Multiple campaigns use the same addresses, enabling tracking of total revenue.
Actor group profiles:
- HARAK1R1: Pioneer of mass MongoDB extortion (December 2016 - January 2017). First to automate the scan→wipe→ransom pipeline at scale. Hit 10,000+ databases in the initial 'MongoDB Apocalypse'. Demanded 0.2 BTC (~$200 at 2017 prices). Set the template all subsequent actors follow. Bitcoin analysis showed ~$28,000 received from initial campaign.
- KRAKEN0: Active 2017-2019. Targeted both MongoDB and Elasticsearch instances. Known for overwriting competitor ransom notes — would wipe databases already ransomed by Harak1r1 and replace with their own note. Demonstrated the 'overwrite' problem: multiple actors competing for the same victims means data is destroyed multiple times.
- CRU3LTY: Active 2018-2020. Focused on smaller databases with indicators of development/startup environments. Demanded lower ransoms ($150-$300) but at higher volume. Operational pattern: scan during weekends when admin response is slowest.
- UNISTELLAR: Active 2019-2021. Larger-scale operations hitting 12,000+ MongoDB instances in single campaigns. Used automated scripts that connected to Shodan API in real-time, maintaining persistent scanning. More sophisticated victim selection: filtered for databases > 100MB (indicating real data vs test instances).
- M0NG0D4T4B4S3: Active 2022-2026. Latest generation extending attacks to Elasticsearch, Redis, Cassandra, and CouchDB. Multi-database scanning pipeline. Higher ransom demands ($500-$1,000) reflecting cryptocurrency price changes. Uses Tor-based email for communication. Represents the evolution from MongoDB-specific to general exposed-database extortion.
- MEOW ATTACKS (2020-2022): Distinctive va
Weaknesses (CWE)
CWE-306, CWE-284
Target sectors: Information Technology, E-Commerce, Healthcare, Education, Startups, Research and Development, Financial Services
Target regions: Global, North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 13 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 47 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
EXTORTION, HIGH, threat intelligence, cybersecurity, T1190, T1485, T1486, T1595, T1596, T1078, T1059, T1213, T1119, T1567