{
  "family": "mongolock",
  "sample_count": 7,
  "category": "ransomware",
  "description": "Ransom:Win32/Mongolock represents a highly specialized and devastating form of extortion that specifically targets unsecured, internet-exposed **MongoDB databases**, rather than individual user files or endpoints. It is a stark reminder of the dangers of cloud misconfigurations. Unlike traditional ransomware that encrypts files in place, Mongolock completely drops (deletes) the victim's databases and replaces them with a single collection containing a ransom demand, often resulting in total, irrecoverable data loss.<br><br><b>Understanding the Mongolock Threat</b><br>To an organization, a Mongolock attack is catastrophic. Their web applications suddenly crash, and upon inspecting the database, all customer records and operational data are gone, replaced by a table named `WARNING` demanding Bitcoin. For cloud security architects, Mongolock highlights a failure in basic access control (`T1190`); the database was left exposed to the public internet without authentication enabled.<br><br><b>Execution and Database Wiping Mechanics</b><br>Mongolock does not rely on phishing or malware payloads on an endpoint. Instead, attackers use automated scanning scripts (like Shodan or Masscan) (`T1595.002`) to scour the internet for MongoDB instances exposed on default port `27017` with no access controls configured (`T1190`). Once a vulnerable instance is found, the attacker's script connects directly to the database. It executes a command to completely drop (delete) all existing databases and collections (`T1485`). It then creates a new database (often named `READ_ME_TO_RECOVER_YOUR_DATA`) and inserts a single document demanding a ransom payment in cryptocurrency (`T1486`). Crucially, in many Mongolock attacks, the attackers *do not* actually back up the data before deleting it; paying the ransom results in nothing.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is immediate, total data loss and massive operational downtime. The primary IoC is the sudden disappearance of all MongoDB collections, replaced by a single ransom note collection. Cloud infrastructure logs (AWS CloudTrail, Azure Activity Log) will show unauthorized inbound connections to port `27017` from unknown IP addresses, followed immediately by massive data deletion commands.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1595.002",
    "T1486",
    "T1190",
    "T1485"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application (Exploiting unauthenticated MongoDB instances)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1595.002",
      "name": "Active Scanning: Vulnerability Scanning (Mass-scanning for port 27017)",
      "tactic": "Reconnaissance"
    },
    {
      "id": "T1485",
      "name": "Data Destruction (Dropping the databases)",
      "tactic": "Impact"
    },
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact (Leaving the ransom note)",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "Immediately alter the cloud firewall/Security Group rules to block all public internet access to the MongoDB instance (Port 27017).",
    "Enable authentication and Role-Based Access Control (RBAC) on the MongoDB instance immediately.",
    "Do not pay the ransom. Mongolock attacks are frequently automated wipers; the attackers rarely exfiltrate or save the data before deleting it.",
    "Restore the database from the most recent secure, offline backup taken before the attack occurred."
  ],
  "what_to_avoid": [
    "Do not expose any database (MongoDB, Redis, Elasticsearch) directly to the public internet without strict IP allowlisting and strong authentication.",
    "Avoid assuming cloud providers secure your data by default; securing database access is a customer responsibility under the Shared Responsibility Model."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}