MongoDB ransacking
 Share
The version of the browser you are using is no longer supported. Please upgrade to a supported browser.Dismiss

 
View only
 
 
Still loading...
ABCDEFGHIJKLMNOPQRSTUVWXYZAAABACADAEAFAG
1
How to secure your MongoDb
https://www.mongodb.com/blog/post/how-to-avoid-a-malicious-attack-that-ransoms-your-data
2
Group nameLast
Sighted on
Email Address(Sighted As)
Bitcoin AddressRansom size
Number of Transactions
Total
BTC Recieved
Name of replaced DB
Known Attacker IPs
Victims (OSINT)Victims (helped)Signature HashLinksFound byNote
3
4
Harak1r1
5
20-12-2017harak1r1@sigaint.org13zaxGVjj9MNc2jyvDRhLyYpkCh323MsMq0.2 BTC233.42602434WARNING92.99.14.33
6
14VaE8NpTBTvx8k4SmteYKwPiu2YeWmuhh0.2 BTC60.800395.211.184.2101962
7
1MMA6YD99vAfzKqhrb3dY91KpSZV6TMd2x0.2 BTC00
8
8-1-2017 12:30:00h4r4k1r1@sigaint.org1LyVyAsQz5TcBH97LdXszmsp8PW7VP3SCp0.5BTC00README_MISSING_DATABASES46.166.173.1062300https://twitter.com/nmerrigan/status/818057700185673728@nmerrigan
SEND 0.5 BTC (BITCOIN) TO THIS ADDRESS 1LyVyAsQz5TcBH97LdXszmsp8PW7VP3SCp AND CONTACT THIS EMAIL WITH IP OF YOUR SERVER TO RECOVER YOUR DATABASE!
9
14QYh7PXnvXGa9ZjFFedA5savFoMySCvQW0.5 BTC00README_MISSING_DATABASES82.73.230.211
e95189a57d3ed6722f6583055e666857351eb69a1064d51c275f98dce22316b4
http://pastebin.com/raw/AtAjguBb@Plazmaz1
10
11
12
1-16-2017 3:38:0315ZDt9prQbyEv2KmSgRxgakTfgyz9SGHu10.2BTC00
13
1-6-2017 9:20:00
0704341626asdf@signaint.org
18eUPJLM79zdXKYWZSzT29fBQScFwU81VR0.15 BTC110.58352161PWNED95.211.184.210261http://pastebin.com/YfpDRfRy@nmerrigan
Your database has been pwned because it is publicly accessible at port 27017 with no authentication (wtf were you thinking?). Your data has been dumped (with data types preserved), and is easily restorable. To get your data back, email the supplied email after sending 0.15BTC to the supplied Bitcoin wallet, do this quickly as after 72 hours your data will be erased (if an email is not sent by then). We will get back to you within 2 days. All of your data will be restored to you upon payment via a email response.
14
PWNED_SECURE_YOUR_STUFF_SILLY64.145.76.227282http://pastebin.com/raw/WgjYJhZ3@Decio_o_o
Your database has been pwned because it is publically accessible at port 27017 with no authentication (wtf were you thinking?). Your data has been dumped (with data types preserved), and is easily restoreable. To get your data back, email the supplied email after sending 0.15BTC to the supplied Bitcoin wallet, do this quickly as after 72 hours your data will be erased (if an email is not sent by then). We will get back to you within 2 days. All of your data will be restored to you upon payment via a email response. We do admit it is possible we overwrote another groups warning after they hit you. In this case, we will refund you 75% and send you the emails of the other groups. We are not animals. In fact, you should be glad we hit you before some groups did something terrible with your data like sell it online
15
16
17
8-1-2017 16:00:00ac34@sigaint.org1GZSWuA7EC1y1cZ2c85CnnsD1cNk67yAUc0.5 BTC00WARNING95.211.184.210@PogoWasRight
Send 0.5 Bitcoin to address 1GZSWuA7EC1y1cZ2c85CnnsD1cNk67yAUc and contact email with server IP to recover database!
18
19
1-8-2017 11:00:00cruelty@sigaint.org13spvvgsv815jXr7nn7iG93DAujUZCwPAJ0.5 BTC00ReadmePlease46.166.173.106173https://twitter.com/nmerrigan/status/818034565700849664@nmerrigan
There Is Always A Solution" : "Your DataBase is downloaded and backed up on our secured servers. To recover your lost data : Send 0.5 BTC to our BitCoin Address and Contact us by eMail with your MongoDB server IP Address and a Proof of Payment. You are welcome!
20
1Pbcnf7zPELLYZiVjfGF9CSyKYtgma1LiA0.5 BTC00ReadmePlease46.165.246.193
There Is Always A Solution" : "Your DataBase is downloaded and backed up on our secured servers. To recover your lost data : Send 0.5 BTC to our BitCoin Address and Contact us by eMail with your MongoDB server IP Address and a Proof of Payment. You are welcome!
21
1EjgCJqmARVGCTwV9DFhag7ZUL8DJcwKaQ0.5 BTC00ReadmePlease
22
23
6-1-2017 20:02:003lix1r@mail2tor.com17w8EBkCgTQJQAQZ9Bzdf2rZeR5xxfCanV0.25 BTC101.999992CONTACTME46.166.173.106715https://twitter.com/nmerrigan/status/817448293131227136@nmerrigan
24
128.199.81.59http://pastebin.com/raw/WHjappBU
25
Kraken0
21-01-2017 17:52:43
kraken0@india.com 1J5ADzFv1gx3fsUPUY1AWktuJ6DF9P6hiF
1 BTC
0.1 BTC
0.2 BTC
11011.30575012PLEASE_READ163.172.68.10522618http://pastebin.com/raw/U2NziaBr@nmerrigan
You DB is backed up on our servers, send 1 BTC to 1J5ADzFv1gx3fsUPUY1AWktuJ6DF9P6hiF then send your ip address to email:kraken0@india.com"
26
1ECAyqGn3A1jPXMCsLPSKTUpgzxKZyU81S0.1 BTC00PLEASE_READ46.165.246.19367@nmerrigan
Your DB is Backed up at our servers, to restore send 0.1 BTC to the Bitcoin Address then send an email with your server ip
27
1NVLhvfTexSW1CB9vR7o6c4wY8HyHeYoh0.1 BTC00PLEASE_READ46.166.173.106@nmerrigan
28
1Hjn6vn6odiapCBMa4mhm1unegrjS3bexV0.5 BTC00PLEASE_READ178.217.187.39http://pastebin.com/raw/kxswqkJV@nmerrigan
29
@kalyptoNet
30
@nmerrigan
Your DB is Backed up at our servers, to restore send 0.5 BTC to the Bitcoin Address then send an email with your server ip
31
1J5ADzFv1gx3fsUPUY1AWktuJ6DF9P6hiF0.2 BTCPLEASE_READ94.242.246.23
82128cdbfbd34a6ec41dd846dee37246251a2620a8ebcb435a1b50ad850e84ce
http://pastebin.com/2C6adEBr@Plazmaz1
Your DB is Backed up at our servers, to restore send 0.2 BTC to the Bitcoin Address then send an email with your server ip
32
1J5ADzFv1gx3fsUPUY1AWktuJ6DF9P6hiF0.2 BTCPLEASE_READ85.93.218.204
82128cdbfbd34a6ec41dd846dee37246251a2620a8ebcb435a1b50ad850e84ce
33
34
0wn3d5-1-2017 12:50:000wn3d@protonmail.com15b7bS8tUg8NpzX2FRJQskEFjWRDg9gy6f0.5 BTC113.3103647WARNING_ALERT185.106.120.15920324https://twitter.com/0xDUDE/status/816795745198231552@nmerrigan
YOUR DBS ARE ENCRYPTED. SEND 0.5 BTC (BITCOIN) ~= 550USD, TO THIS BTC ADDRESS: 15b7bS8tUg8NpzX2FRJQskEFjWRDg9gy6f AND CONTACT THIS EMAIL: 0wn3d@protonmail.com WITH THE IP OF YOUR LOCKED SERVER TO RECOVER YOUR DBS!
35
36
mongo3l1t3@sigaint.org5-1-2017 12:00:00mongo3l1t3@sigaint.org1j4ocBecBanTwjLsxLfiE7iWjMJGHdZGB0.2 BTC10.21WARNING193.107.145.207https://twitter.com/0xDUDE/status/817203408109260800@nmerrigan
SEND 0.2 BTC TO THIS ADDRESS 1j4ocBecBanTwjLsxLfiE7iWjMJGHdZGB AND CONTACT THIS EMAIL WITH YOUR IP OF YOUR SERVER TO RECOVER YOUR DATABASE !
37
38
China016-1-2017 13:52:001DGztzLNz1euFswtqMDWPMWSgwthdpxRtC1 BTC
to_get_DB_back_send_1BTC_to_1DGztzLNz1euFswtqMDWPMWSgwthdpxRtC
1@nmerrigan
to_get_DB_back_send_1BTC_to_1DGztzLNz1euFswtqMDWPMWSgwthdpxRtC
39
40
41
byterot28-07-2015Overwritten by READ10
DELETED_BECAUSE_YOU_DIDNT_PASSWORD_PROTECT_YOUR_MONGODB
89.248.167.15945
https://twitter.com/MongoDBatSO/status/625905480708304896
https://stackoverflow.com/questions/31668222/mongodb-throws-delete-message-deleted-because-you-didnt-password-protect-your-m
@nmerrigan
Early to mid 2016 first spotted .. However it is leading to other IOCs
42
43
admin_stolen7-1-2017 13:0034
44
45
pwned7-1-2017 17:3041626asdf@sigaint.org@nmerriganAlternate signature. Looking for evidence.
46
47
mongodbrestore7-1-2017 20:02:00
mongodbrestore@sigaint.org
1Hhb4rJY7hYFMLwE1j1834zWsNBRWXN9Sv0.2 BTCPLEASE_READ@nmerrigan
SEND 0.2 BTC TO THIS ADDRESS 1Hhb4rJY7hYFMLwE1j1834zWsNBRWXN9Sv AND CONTACT THIS EMAIL WITH YOUR IP OF YOUR SERVER TO RECOVER YOUR DATABASE !
48
7-1-2017 20:02:00
mongodbrestore@sigaint.org
1Hhb4rJY7hYFMLwE1j1834zWsNBRWXN9Sv0.2 BTCPLEASE_READ_56b41cc944bd390932e7982768Reported by @PogoWasRight
49
50
bitcoin_cn@n8.gs8-1-2017 20:50:00bitcoin_cn@n8.gs3Dkg1VxLpmLB2SsGnPoFFbnndMnJcczVUo1BTCREADME1.234.31.28354https://twitter.com/0xDUDE/status/818211338157772801@nmerrigan
Your DB is Backed up at our servers, to restore send 1.0 BTC to the Bitcoin Address then send an email with your server ip
51
52
S0mBR49-1-2017 22:28:00s0mbr4@sigaint.orgLEIA_ME1@tomahockTenha mais cuidado com o seu banco de dados!
53
AVISO_LEIA_ME46.59.107.734@nmerrigan
NA PRÓXIMA, TENHA MAIS CUIDADO COM O SEU BANCO DE DADOS!
54
55
56
atalie99@sigaint.org10-1-2017 10:30:00atalie99@sigaint.org14vo1ZB8Gi9duKcCVa6zUpdiRRpCz5GKBF0.1BTC906.05210557IHAVEYOURDATA59.203.28.288@nmerrigan
Your DB is Backed up at our servers, to restore send 0.1 BTC to the Bitcoin Address then send an email with your server ip
57
58
bitcoinbaron@protonmail.com10-1-2017 14:00:00
bitcoinbaron@protonmail.com
17KdFUA9WJTTwYNp4iRPjLyLDkBfiz2zj60.2BTCREAD_ME18@nmerrigan
Your DB is Backed up at our servers, to restore send 0.2 BTC to the Bitcoin Address then send an email with your server ip
59
60
10-1-2017READMEPLS 5@nmerrigan
Note: 5 servers in Germany attacked.. looking for Note and information
This is clearly a targeted attack on 1 company
61
62
baby8@sigaint.org10-1-2017baby8@sigaint.org0.5BTCENCRYPTED94.242.246.23619@nmerrigan
DBS ENCRYPTED. CONTACT baby8@sigaint.org TO RECOVER YOUR DBS!
63
64
harunkus@sigaint.org10-1-2017harunkus@sigaint.org1GMCQAuuVJWWRpDdA919VVMDU7VEwDnicM0.1BTCREAD1217.26.212.534222@nmerrigan
SEND 0.1 BTC TO THIS ADDRESS 1GMCQAuuVJWWRpDdA919VVMDU7VEwDnicM AND CONTACT THIS EMAIL WITH IP OF YOUR SERVER TO RECOVER YOUR DATABASE !
65
66
insecuredb@sigaint.org11-1-2017 13:00:00insecuredb@sigaint.org1CRtmFHhDL83sgg8Gwd8gZEW7rgvjNCrGF0.1BTCREADME_YOU_DB_IS_INSECURE109.201.133.100510@nmerrigan
NOTE : "SEND 0.1 BTC TO THIS ADDRESS 1CRtmFHhDL83sgg8Gwd8gZEW7rgvjNCrGF AND CONTACT THIS EMAIL WITH IP OF YOUR SERVER TO RECOVER YOUR DATABASE! ", NOTICE : "IF YOU DO NOT PAY YOUR DATABASE WILL BE PUBLISHED ONLINE EVERYONE WILL KNOW YOUR BREACH OF SECURITY"
67
68
mChac4l11-1-2017 22:30:00mchac4l@sigaint.orgAVISO18@nmerriganTenha mais cuidado com o seu banco de dados!
69
70
m3lk@sigaint.org
16-1-2017 07:08:52
m3lk@sigaint.org1PWFTSbye9hzfp6RH453hDJb2Ujeice8ZQ0.1 BTC00WARNING95.211.153.138http://pastebin.com/29fGsV7i@Plazmaz1
Send 0.1 Bitcoin to walletaddress 1PWFTSbye9hzfp6RH453hDJb2Ujeice8ZQ and contact m3lk@sigaint.org to get your databases back.
71
131qpnP9v2qGKbrAQirCZzunyw5x3dADsB0.1 BTC00https://twitter.com/jorgerdz/status/821471730526982148@jorgerdz
Send 0.1 Bitcoin to walletaddress 131qpnP9v2qGKbrAQirCZzunyw5x3dADsBand contact m3lk@sigaint.org to get your databases back.
72
73
hacken.m@india.com16-1-2017 12:57hacken.m@india.com1QJLAmsrXDuqDo3H2aaBPHuJxjZkTMx1DQ0.05 BTC30.097PLEASE_READ_ME121@nmerrigan
Your DB is Backed up at our servers, to restore send 0.05 BTC to the Bitcoin Address then send an email with your server ip
74
mongobackup7@sigaint.org
19-1-2017 19:20:54
mongobackup7@sigaint.org1AwkbxDziATSXAbqkLhrqCSsqvGr3PHgjU0.1 BTC00PLEASE_READ_ME198.211.119.1121
40e95a2d6fb476409a54809789f0b211bc79309b0872bfc31fc0e02b8c2e0948
https://twitter.com/Plazmaz1/status/821936047986802692@Plazmaz1
Your DB is Backed up at our servers, to restore send 0.1 BTC to the Bitcoin Address then send an email with your server ip
75
http://pastebin.com/9sB7ywgH
Your DB is Backed up at our servers, to restore send 0.1 BTC to the Bitcoin Address then send an email with your server ip (or domain name)
76
storybehind@sigaint.org
1-15-2017 17:23:16.775
storybehind@sigaint.org13QAcXUtNA9UGHPRy1GLDE9zWsDCbKzf2B0.2BTC00README_MISSING_DATABASES94.209.230.164
86f625b35ea2bf8c0cee68d0bf2a3b77d0c9a2f804b310e863860d15fe1145b9
http://pastebin.com/haCPa57t@Plazmaz1
SEND 0.5 BTC (BITCOIN) TO THIS ADDRESS 13QAcXUtNA9UGHPRy1GLDE9zWsDCbKzf2B AND CONTACT THIS EMAIL WITH IP OF YOUR SERVER TO RECOVER YOUR DATABASE!
77
78
Total26223.46173434537121
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
Loading...
 
 
 
Actors
Payment Blacklist
Victims aided
old