- Joined
- Jan 22, 2026
- Messages
- 101
- Reaction score
- 931
A quiet little thing that everyone forgets about can turn your data into someone else's trophy.
The problem of ransomware attacks on MongoDB databases has not disappeared, despite the decline in public debate in recent years. A new study from Flare specialists shows that the campaign of infection and blackmail continues today, relying not on complex vulnerabilities, but on massive errors in infrastructure settings.
The scheme is based on a simple mechanism. MongoDB instances that are deployed without authentication and with open access from the Internet enter the network. Attackers automatically find such databases, copy or delete the data, and leave a message demanding that a ransom be transferred in cryptocurrency. After that, organizations often lose information forever, even if they agree to pay.
The reason for the new analysis was a real audit of the infrastructure of a medium-sized business company, where open MongoDB instances with buyback notes were found. After that, the team deployed a bait in the form of specially open databases in different regions of the world and in just a few days recorded their compromise. At the same time, an analysis of open sources, forums and the darknet was conducted, where detailed instructions on such attacks were found, designed even for people without technical training.
Special attention was paid to the spread of unsafe configurations through ready-made container images and code examples. Research has shown that hundreds of containers in public repositories contain settings that allow you to connect to MongoDB from any IP address without a password. Combined with port forwarding, this turns a convenient configuration for development into a fully open database on the Internet.
An analysis of the global Internet space revealed more than 200,000 servers with MongoDB available. About 3.1 thousand of them turned out to be completely open, and almost half have already been compromised with the replacement of data with ransom demands. Almost all of the attacks were linked to the same cryptocurrencies, indicating a single dominant campaign operator. The potential revenue from such attacks can be in the hundreds of thousands of dollars.
The authors of the report emphasize that the main risk is caused not by exploiting vulnerabilities, but by configuration errors. They are the ones who turn MongoDB into easy prey and make such attacks scalable and cheap. According to them, as long as the ecosystem retains the practice of copying ready-made settings and deploying services without basic protection measures, the extortion campaign will continue, remaining a stable source of income for intruders and a serious threat to business.
The problem of ransomware attacks on MongoDB databases has not disappeared, despite the decline in public debate in recent years. A new study from Flare specialists shows that the campaign of infection and blackmail continues today, relying not on complex vulnerabilities, but on massive errors in infrastructure settings.
The scheme is based on a simple mechanism. MongoDB instances that are deployed without authentication and with open access from the Internet enter the network. Attackers automatically find such databases, copy or delete the data, and leave a message demanding that a ransom be transferred in cryptocurrency. After that, organizations often lose information forever, even if they agree to pay.
The reason for the new analysis was a real audit of the infrastructure of a medium-sized business company, where open MongoDB instances with buyback notes were found. After that, the team deployed a bait in the form of specially open databases in different regions of the world and in just a few days recorded their compromise. At the same time, an analysis of open sources, forums and the darknet was conducted, where detailed instructions on such attacks were found, designed even for people without technical training.
Special attention was paid to the spread of unsafe configurations through ready-made container images and code examples. Research has shown that hundreds of containers in public repositories contain settings that allow you to connect to MongoDB from any IP address without a password. Combined with port forwarding, this turns a convenient configuration for development into a fully open database on the Internet.
An analysis of the global Internet space revealed more than 200,000 servers with MongoDB available. About 3.1 thousand of them turned out to be completely open, and almost half have already been compromised with the replacement of data with ransom demands. Almost all of the attacks were linked to the same cryptocurrencies, indicating a single dominant campaign operator. The potential revenue from such attacks can be in the hundreds of thousands of dollars.
The authors of the report emphasize that the main risk is caused not by exploiting vulnerabilities, but by configuration errors. They are the ones who turn MongoDB into easy prey and make such attacks scalable and cheap. According to them, as long as the ecosystem retains the practice of copying ready-made settings and deploying services without basic protection measures, the extortion campaign will continue, remaining a stable source of income for intruders and a serious threat to business.
