Automated Ransomware Campaigns Target MongoDB Instances

Automated Ransomware Campaigns Target MongoDB Instances

First seen 2 Feb 2026, 16:12 UTC •BleepingcomputerGbhackersCybersecuritynewsCyberpressFeeds.Feedburner+6 •91% similarity •31.3

Article Content

Browse articles
ThreatCluster

Threat actors are conducting large-scale ransomware attacks on unsecured MongoDB instances. These attacks involve scanning for publicly accessible databases, deleting their contents, and placing ransom notes demanding Bitcoin payments. The campaigns are reported to be highly profitable despite relatively low ransom demands.

ThreatCluster AI How this analysis works

Extracted Entities

1 / 2

Community

Browse all →

Tracked Entities in This Story

IDHS MongoDB Kubernetes