MongoDB Servers Left Exposed Are Being Wiped and Ransomed — No Malware Required

February 27, 2026•3 min read

A long-running ransomware operation targeting misconfigured MongoDB databases is actively wiping servers and planting ransom notes — and the attack doesn’t rely on exploits, malware, or advanced tooling.

Instead, threat actors are capitalizing on a far simpler weakness: databases exposed to the internet with no authentication.

Recent research confirms that this campaign, which first surged years ago, never truly went away. It simply waited for insecure deployments to persist — and they have.

🚨 A Familiar Attack Returns

Between 2017 and 2021, MongoDB ransom attacks affected thousands of organizations worldwide. Public attention faded, but attacker activity did not.

In late 2025, researchers deployed unauthenticated MongoDB honeypots across multiple regions. Within days, every instance was compromised and replaced with Bitcoin ransom notes demanding ~$500.

Penetration testing soon uncovered real-world victims as well — including multiple compromised databases at a small-to-medium business — confirming the threat is active, automated, and ongoing.

⚙️ How the Attack Works (No Exploit Needed)

This campaign succeeds because of configuration negligence, not technical complexity.

Attackers follow a simple four-step process:

Scan the internet for MongoDB services exposed on port 27017
Connect without credentials to databases that allow open access
Copy or dump data (sometimes optional)
Delete every database and collection, replacing them with a ransom note

The ransom note typically demands payment within 48 hours, threatening permanent data loss.

Security researchers strongly advise never paying the ransom — many victims report receiving nothing in return, and in numerous cases attackers never actually retained usable backups of the data.

🌍 The Scope of Exposure

Internet-wide scanning reveals the scale of the problem:

200,000+ MongoDB servers publicly discoverable
100,000+ leaking operational metadata
3,100 fully exposed with no authentication
1,416 (45.6%) already wiped and ransomed

Almost every compromised instance demanded the same ~$500 Bitcoin payment.

Even more telling:
Over 98% of ransom notes pointed to a single Bitcoin wallet, strongly indicating one dominant threat actor running the operation at scale.

Depending on how many victims paid, estimated attacker revenue ranges from $0 to ~$842,000 USD — all from misconfigurations alone.

🧨 Insecure Defaults Are Fueling the Campaign

Researchers traced the root cause back to copy-paste deployment culture.

Key findings include:

763 Docker images on Docker Hub and GitHub shipping MongoDB bound to 0.0.0.0 with no authentication
30 namespaces distributing insecure configs in just three months
Multiple images exceeding 15,000 pulls
17,900+ exposed MongoDB credentials discovered across public repos, paste sites, breach dumps, and dark web forums
~50% of those credentials were still valid

Attack tutorials circulating on Tor and underground forums openly advertise MongoDB ransom attacks as:

“No skills needed. If you can copy and paste, you’re good to go.”

This is ransomware reduced to a business model for beginners.

🧭 MITRE ATT&CK: Simple, But Effective

Despite its simplicity, the campaign maps cleanly to MITRE ATT&CK:

No malware
No privilege escalation
No lateral movement

Attackers operate entirely within the permissions granted by insecure configurations, making prevention far easier than detection — if organizations act in time.

🛡️ The Elliptic Systems Perspective

This campaign proves a hard truth:

Most “ransomware” today succeeds because of preventable exposure — not elite hacking.

At Elliptic Systems, we help organizations eliminate these risks by: