ABCDEFGHIJKLMNOPQRSTUVWXYZAAABACADAEAFAG
1
2
How to secure your MongoDb
https://www.mongodb.com/blog/post/how-to-avoid-a-malicious-attack-that-ransoms-your-data
3
ActorFirst
Sighted on		Email Address(Sighted As)Bitcoin AddressRansom size
Number of Transactions
Total
BTC Recieved		Name of replaced DB
Known Attacker IPs
Victims (OSINT)
Victims (helped)
Signature HashLinksFound byNote
4
5
Harak1r1
6
20-12-2016harak1r1@sigaint.org13zaxGVjj9MNc2jyvDRhLyYpkCh323MsMq0.2 BTC233.42602434WARNING92.99.14.33
7
14VaE8NpTBTvx8k4SmteYKwPiu2YeWmuhh0.2 BTC60.800395.211.184.2102074
8
1MMA6YD99vAfzKqhrb3dY91KpSZV6TMd2x0.2 BTC00
9
8-1-2017 12:30:00h4r4k1r1@sigaint.org1LyVyAsQz5TcBH97LdXszmsp8PW7VP3SCp0.5BTC00README_MISSING_DATABASES46.166.173.1062553https://twitter.com/nmerrigan/status/818057700185673728@nmerrigan
SEND 0.5 BTC (BITCOIN) TO THIS ADDRESS 1LyVyAsQz5TcBH97LdXszmsp8PW7VP3SCp AND CONTACT THIS EMAIL WITH IP OF YOUR SERVER TO RECOVER YOUR DATABASE!
10
14QYh7PXnvXGa9ZjFFedA5savFoMySCvQW0.5 BTC00README_MISSING_DATABASES82.73.230.211
e95189a57d3ed6722f6583055e666857351eb69a1064d51c275f98dce22316b4
http://pastebin.com/raw/AtAjguBb@Plazmaz
11
12
13
1-16-2017 3:38:0315ZDt9prQbyEv2KmSgRxgakTfgyz9SGHu10.2BTC00
14
1-6-2017 9:20:00
0704341626asdf@signaint.org
18eUPJLM79zdXKYWZSzT29fBQScFwU81VR0.15 BTC110.58352161PWNED95.211.184.210252http://pastebin.com/YfpDRfRy@nmerrigan
Your database has been pwned because it is publicly accessible at port 27017 with no authentication (wtf were you thinking?). Your data has been dumped (with data types preserved), and is easily restorable. To get your data back, email the supplied email after sending 0.15BTC to the supplied Bitcoin wallet, do this quickly as after 72 hours your data will be erased (if an email is not sent by then). We will get back to you within 2 days. All of your data will be restored to you upon payment via a email response.
15
PWNED_SECURE_YOUR_STUFF_SILLY64.145.76.2272347http://pastebin.com/raw/WgjYJhZ3@Decio_o_o
Your database has been pwned because it is publically accessible at port 27017 with no authentication (wtf were you thinking?). Your data has been dumped (with data types preserved), and is easily restoreable. To get your data back, email the supplied email after sending 0.15BTC to the supplied Bitcoin wallet, do this quickly as after 72 hours your data will be erased (if an email is not sent by then). We will get back to you within 2 days. All of your data will be restored to you upon payment via a email response. We do admit it is possible we overwrote another groups warning after they hit you. In this case, we will refund you 75% and send you the emails of the other groups. We are not animals. In fact, you should be glad we hit you before some groups did something terrible with your data like sell it online
16
17
18
8-1-2017 16:00:00ac34@sigaint.org1GZSWuA7EC1y1cZ2c85CnnsD1cNk67yAUc0.5 BTC00WARNING95.211.184.210@PogoWasRight
Send 0.5 Bitcoin to address 1GZSWuA7EC1y1cZ2c85CnnsD1cNk67yAUc and contact email with server IP to recover database!
19
20
1-8-2017 11:00:00cruelty@sigaint.org13spvvgsv815jXr7nn7iG93DAujUZCwPAJ0.5 BTC00ReadmePlease46.166.173.106764https://twitter.com/nmerrigan/status/818034565700849664@nmerrigan
There Is Always A Solution" : "Your DataBase is downloaded and backed up on our secured servers. To recover your lost data : Send 0.5 BTC to our BitCoin Address and Contact us by eMail with your MongoDB server IP Address and a Proof of Payment. You are welcome!
21
1Pbcnf7zPELLYZiVjfGF9CSyKYtgma1LiA0.5 BTC00ReadmePlease46.165.246.193
There Is Always A Solution" : "Your DataBase is downloaded and backed up on our secured servers. To recover your lost data : Send 0.5 BTC to our BitCoin Address and Contact us by eMail with your MongoDB server IP Address and a Proof of Payment. You are welcome!
22
1EjgCJqmARVGCTwV9DFhag7ZUL8DJcwKaQ0.5 BTC00ReadmePlease
23
24
6-1-2017 20:02:003lix1r@mail2tor.com17w8EBkCgTQJQAQZ9Bzdf2rZeR5xxfCanV0.25 BTC101.999992CONTACTME46.166.173.1064224https://twitter.com/nmerrigan/status/817448293131227136@nmerrigan
25
128.199.81.59http://pastebin.com/raw/WHjappBU
26
Kraken0
21-01-2017 17:52:43
kraken0@india.com 1J5ADzFv1gx3fsUPUY1AWktuJ6DF9P6hiF1 BTC
0.1 BTC
0.2 BTC		11011.30575012PLEASE_READ163.172.68.105153http://pastebin.com/raw/U2NziaBr@nmerrigan
You DB is backed up on our servers, send 1 BTC to 1J5ADzFv1gx3fsUPUY1AWktuJ6DF9P6hiF then send your ip address to email:kraken0@india.com"
27
1ECAyqGn3A1jPXMCsLPSKTUpgzxKZyU81S0.1 BTC00PLEASE_READ46.165.246.19367@nmerrigan
Your DB is Backed up at our servers, to restore send 0.1 BTC to the Bitcoin Address then send an email with your server ip
28
1NVLhvfTexSW1CB9vR7o6c4wY8HyHeYoh0.1 BTC00PLEASE_READ46.166.173.106@nmerrigan
29
1Hjn6vn6odiapCBMa4mhm1unegrjS3bexV0.5 BTC00PLEASE_READ178.217.187.39http://pastebin.com/raw/kxswqkJV@nmerrigan
30
5.189.188.111@kalyptoNet
31
@nmerrigan
Your DB is Backed up at our servers, to restore send 0.5 BTC to the Bitcoin Address then send an email with your server ip
32
1J5ADzFv1gx3fsUPUY1AWktuJ6DF9P6hiF0.2 BTCPLEASE_READ94.242.246.23
82128cdbfbd34a6ec41dd846dee37246251a2620a8ebcb435a1b50ad850e84ce
http://pastebin.com/2C6adEBr@Plazmaz
Your DB is Backed up at our servers, to restore send 0.2 BTC to the Bitcoin Address then send an email with your server ip
33
1J5ADzFv1gx3fsUPUY1AWktuJ6DF9P6hiF0.2 BTCPLEASE_READ85.93.218.204
82128cdbfbd34a6ec41dd846dee37246251a2620a8ebcb435a1b50ad850e84ce
34
35
0wn3d5-1-2017 12:50:000wn3d@protonmail.com15b7bS8tUg8NpzX2FRJQskEFjWRDg9gy6f0.5 BTC113.3103647WARNING_ALERT185.106.120.15919924https://twitter.com/0xDUDE/status/816795745198231552@nmerrigan
YOUR DBS ARE ENCRYPTED. SEND 0.5 BTC (BITCOIN) ~= 550USD, TO THIS BTC ADDRESS: 15b7bS8tUg8NpzX2FRJQskEFjWRDg9gy6f AND CONTACT THIS EMAIL: 0wn3d@protonmail.com WITH THE IP OF YOUR LOCKED SERVER TO RECOVER YOUR DBS!
36
37
mongo3l1t3@sigaint.org5-1-2017 12:00:00mongo3l1t3@sigaint.org1j4ocBecBanTwjLsxLfiE7iWjMJGHdZGB0.2 BTC10.21WARNING193.107.145.207https://twitter.com/0xDUDE/status/817203408109260800@nmerrigan
SEND 0.2 BTC TO THIS ADDRESS 1j4ocBecBanTwjLsxLfiE7iWjMJGHdZGB AND CONTACT THIS EMAIL WITH YOUR IP OF YOUR SERVER TO RECOVER YOUR DATABASE !
38
39
China016-1-2017 13:52:001DGztzLNz1euFswtqMDWPMWSgwthdpxRtC1 BTC
to_get_DB_back_send_1BTC_to_1DGztzLNz1euFswtqMDWPMWSgwthdpxRtC
1@nmerrigan
to_get_DB_back_send_1BTC_to_1DGztzLNz1euFswtqMDWPMWSgwthdpxRtC
40
41
byterot28-07-2015Overwritten by READ10
DELETED_BECAUSE_YOU_DIDNT_PASSWORD_PROTECT_YOUR_MONGODB
89.248.167.15945
https://twitter.com/MongoDBatSO/status/625905480708304896
https://stackoverflow.com/questions/31668222/mongodb-throws-delete-message-deleted-because-you-didnt-password-protect-your-m
@nmerriganEarly to mid 2016 first spotted .. However it is leading to other IOCs
42
43
admin_stolen7-1-2017 13:0034
44
45
pwned7-1-2017 17:3041626asdf@sigaint.org@nmerriganAlternate signature. Looking for evidence.
46
47
mongodbrestore7-1-2017 20:02:00mongodbrestore@sigaint.org1Hhb4rJY7hYFMLwE1j1834zWsNBRWXN9Sv0.2 BTCPLEASE_READ3621@nmerrigan
SEND 0.2 BTC TO THIS ADDRESS 1Hhb4rJY7hYFMLwE1j1834zWsNBRWXN9Sv AND CONTACT THIS EMAIL WITH YOUR IP OF YOUR SERVER TO RECOVER YOUR DATABASE !
48
7-1-2017 20:02:00mongodbrestore@sigaint.org1Hhb4rJY7hYFMLwE1j1834zWsNBRWXN9Sv0.2 BTC
PLEASE_READ_56b41cc944bd390932e79827
68Reported by @PogoWasRight
49
50
bitcoin_cn@n8.gs8-1-2017 20:50:00bitcoin_cn@n8.gs3Dkg1VxLpmLB2SsGnPoFFbnndMnJcczVUo1BTCREADME1.234.31.28682https://twitter.com/0xDUDE/status/818211338157772801@nmerrigan
Your DB is Backed up at our servers, to restore send 1.0 BTC to the Bitcoin Address then send an email with your server ip
51
52
S0mBR49-1-2017 22:28:00s0mbr4@sigaint.orgLEIA_ME1@tomahockTenha mais cuidado com o seu banco de dados!
53
AVISO_LEIA_ME46.59.107.734@nmerriganNA PRÓXIMA, TENHA MAIS CUIDADO COM O SEU BANCO DE DADOS!
54
55
56
atalie99@sigaint.org10-1-2017 10:30:00atalie99@sigaint.org14vo1ZB8Gi9duKcCVa6zUpdiRRpCz5GKBF0.1BTC906.05210557IHAVEYOURDATA59.203.28.288@nmerrigan
Your DB is Backed up at our servers, to restore send 0.1 BTC to the Bitcoin Address then send an email with your server ip
57
58
bitcoinbaron@protonmail.com10-1-2017 14:00:00bitcoinbaron@protonmail.com17KdFUA9WJTTwYNp4iRPjLyLDkBfiz2zj60.2BTCREAD_ME18@nmerrigan
Your DB is Backed up at our servers, to restore send 0.2 BTC to the Bitcoin Address then send an email with your server ip
59
60
10-1-2017READMEPLS 5@nmerrigan
Note: 5 servers in Germany attacked.. looking for Note and information
This is clearly a targeted attack on 1 company
61
62
baby8@sigaint.org10-1-2017baby8@sigaint.org0.5BTCENCRYPTED94.242.246.2343@nmerrigan
DBS ENCRYPTED. CONTACT baby8@sigaint.org TO RECOVER YOUR DBS!
63
64
harunkus@sigaint.org10-1-2017harunkus@sigaint.org1GMCQAuuVJWWRpDdA919VVMDU7VEwDnicM0.1BTCREAD1217.26.212.534034@nmerrigan
SEND 0.1 BTC TO THIS ADDRESS 1GMCQAuuVJWWRpDdA919VVMDU7VEwDnicM AND CONTACT THIS EMAIL WITH IP OF YOUR SERVER TO RECOVER YOUR DATABASE !
65
66
insecuredb@sigaint.org11-1-2017 13:00:00insecuredb@sigaint.org1CRtmFHhDL83sgg8Gwd8gZEW7rgvjNCrGF0.1BTCREADME_YOU_DB_IS_INSECURE109.201.133.1001995@nmerrigan
NOTE : "SEND 0.1 BTC TO THIS ADDRESS 1CRtmFHhDL83sgg8Gwd8gZEW7rgvjNCrGF AND CONTACT THIS EMAIL WITH IP OF YOUR SERVER TO RECOVER YOUR DATABASE! ", NOTICE : "IF YOU DO NOT PAY YOUR DATABASE WILL BE PUBLISHED ONLINE EVERYONE WILL KNOW YOUR BREACH OF SECURITY"
67
68
mChac4l11-1-2017 22:30:00mchac4l@sigaint.orgAVISO18@nmerriganTenha mais cuidado com o seu banco de dados!
69
70
m3lk@sigaint.org16-1-2017 07:08:52m3lk@sigaint.org1PWFTSbye9hzfp6RH453hDJb2Ujeice8ZQ0.1 BTC00WARNING95.211.153.138http://pastebin.com/29fGsV7i@Plazmaz
Send 0.1 Bitcoin to walletaddress 1PWFTSbye9hzfp6RH453hDJb2Ujeice8ZQ and contact m3lk@sigaint.org to get your databases back.
71
131qpnP9v2qGKbrAQirCZzunyw5x3dADsB0.1 BTC00https://twitter.com/jorgerdz/status/821471730526982148@jorgerdz
Send 0.1 Bitcoin to walletaddress 131qpnP9v2qGKbrAQirCZzunyw5x3dADsBand contact m3lk@sigaint.org to get your databases back.
72
73
hacken.m@india.com16-1-2017 12:57hacken.m@india.com1QJLAmsrXDuqDo3H2aaBPHuJxjZkTMx1DQ0.05 BTC30.097PLEASE_READ_ME5913@nmerrigan
Your DB is Backed up at our servers, to restore send 0.05 BTC to the Bitcoin Address then send an email with your server ip
74
mongobackup7@sigaint.org19-1-2017 19:20:54mongobackup7@sigaint.org1AwkbxDziATSXAbqkLhrqCSsqvGr3PHgjU0.1 BTC00PLEASE_READ_ME198.211.119.1121
40e95a2d6fb476409a54809789f0b211bc79309b0872bfc31fc0e02b8c2e0948
https://twitter.com/Plazmaz/status/821936047986802692@Plazmaz
Your DB is Backed up at our servers, to restore send 0.1 BTC to the Bitcoin Address then send an email with your server ip
75
http://pastebin.com/9sB7ywgH
Your DB is Backed up at our servers, to restore send 0.1 BTC to the Bitcoin Address then send an email with your server ip (or domain name)
76
storybehind@sigaint.org
1-15-2017 17:23:16.775
storybehind@sigaint.org13QAcXUtNA9UGHPRy1GLDE9zWsDCbKzf2B0.2BTC00README_MISSING_DATABASES94.209.230.1642663
86f625b35ea2bf8c0cee68d0bf2a3b77d0c9a2f804b310e863860d15fe1145b9
http://pastebin.com/haCPa57t@Plazmaz
SEND 0.5 BTC (BITCOIN) TO THIS ADDRESS 13QAcXUtNA9UGHPRy1GLDE9zWsDCbKzf2B AND CONTACT THIS EMAIL WITH IP OF YOUR SERVER TO RECOVER YOUR DATABASE!
77
78
m4l1c3@sigaint.org31.01.2017 08:30m4l1c3@sigaint.org1B5PMtKhqC97ppNrixfkyT1chQuvDGXXei0.5BTCDB_H4CK3D88.87.85.346304http://pastebin.com/raw/B2vDG3pV@nmerrigan
There Is Always A Solution" : "Your DataBase is downloaded and backed up on our secured servers. To recover your lost data : Send 0.5 BTC to our BitCoin Address and Contact us by eMail with your MongoDB server IP Address and a Proof of Payment. Any eMail without your MongoDB server IP Address and a Proof of Payment together will be ignored. You are welcome!"
79
08-02-2017 20:571NHrbhXmSzzCa8VhWqsza82NaUynxs0.5BTCDB_H4CK3D93.76.244.164
80
81
vxware@sigaint.org14-03-2017vxware@sigaint.org1B4kMRmY4yb4XW8hHnYRZT1WWNfnPfPbHR0.2BTCPLEASEREAD5066nmerrigan
YOU HAVE BEEN HACKED. SEND 0.2 BITCOIN TO BITCOIN ADDRESS 1B4kMRmY4yb4XW8hHnYRZT1WWNfnPfPbHR AND EMAIL vxware@sigaint.org WITH YOUR SERVER IP TO RECOVER YOUR DATABASES. HOW TO BUY BITCOIN: https://www.coinbase.com/buy-bitcoin https://en.bitcoin.it/wiki/Buying_Bitcoins_(the_newbie_version)
82
83
mongodb@protonmail.ch04-04-2017mongodb@protonmail.ch15b9fd5J9XU3txwcMjAtDAGuA8y7oVTSo20.1 BTC30.3DB_DROPPED62.244.25.21232053@0xDUDE
"Don't panic. Your DB is in safety and backed up (check logs). To restore send 0.1 BTC and email with your server ip or domain name. Each 48 hours we erase all data.
84
DATA_HAS_BEEN_BACKED_UP
85
request@tfwno.gf15-06-2017request@tfwno.gf1JjNwP7kXyvP38xbFhxbmebHAZFvnfXHt80.1 BTCREQUEST_YOUR_DATA2494@0xDUDE
Your DB is in safety and backed up (check logs). To restore send 0.1 BTC and email with your server ip or domain name. Each 24 hours we erase all data.
86
87
mongodb@tfwno.gf29-07-2017mongodb@tfwno.gf1JFit9663zGV6v2Mb9cSUpRm2dVptvqfPZ0.2 BTC@0xDUDE
Don't panic. Your DB is in safety and backed up (check logs). To restore send 0.2 BTC and email with your server ip or domain name. Each 24 hours we erase all data.
88
89
datarequest@secmail.pro17-08-2017datarequest@secmail.pro1AtCBPNFDW7b3edenA2v3bprLUVkccPN610.2 BTC0BACKUP_DB78.63.161.0107https://pastebin.com/raw/LUiXB1LC@0xDUDE
We have your data. Your database is backed up to our servers. If you want to restore it, then send 0.2 BTC and text me to email, just send your IP-add...
90
91
cru3lty@safe-mail.net09-25-2017cru3lty@safe-mail.net1ConGo1xRHCh3K6L1ywL4U1KHuC7XYQGqU0.2 BTC70.60313418Warning207.226.141.3622449https://pastebin.com/raw/QWKasciv@Plazmaz
Your DataBase is downloaded and backed up on our secured servers. To recover your lost data: Send 0.2 BTC to our BitCoin Address and Contact us by eMail with your MongoDB server IP Address and a Proof of Payment. Any eMail without your MongoDB server IP Address and a Proof of Payment together will be ignored. You are welcome!
92
1Ptza47PgMtFMA6fZpLNzacb1EPkWDAv6n30.6209.9.108.151https://pastebin.com/raw/BcxJS3PM
93
wolsec@secmail.pro02-09-2017wolsec@secmail.pro1Mk61Q8squW8WjSWp3qEAYL6pu9TR1Cro90.05 BTC0Attention3516@Plazmaz
If you want to recover your data, then send 0.05 BTC to bitcoin-address and send your IP to our email. You don't want that your users/customers to know that you have a data leak, right?
94
95
mongodb@tfwno.gf02-09-2017mongodb@tfwno.gf1E7TCtPCCwd1wPyFHXrGbNECfaEzMjzGHg0.15 BTC0Attention176.126.252.11839https://pastebin.com/raw/vzFbTVSb@0xDUDE
We have your data. Your database is backed up to our servers. If you want to restore it, then send 0.15 BTC and text me to email, just send your IP-address and payment info. Messages without payment info will be ignored
96
1JFit9663zGV6v2Mb9cSUpRm2dVptvqfPZ0.2 BTC2WE_HAVE_YOUR_DATA104.237.130.165
@MayhemDayOne
Don't panic. Your DB is in safety and backed up (check logs). To restore send 0.2 BTC and email with your server ip or domain name. Each 24 hours we erase all data
97
98
butterfly@safe-mail.net10-01-2018butterfly@safe-mail.net13yDqr3VptUpYr84s3id3HFAd3HC1KmLPm0.1 BTC0Warning207.226.141.1818372@0xDUDE
"BitCoin" : "13yDqr3VptUpYr84s3id3HFAd3HC1KmLPm", "eMail" : "butterfly@safe-mail.net", "Exchange" : "https://localbitcoins.com or https://www.okex.com", "Solution" : "Your Data is downloaded and backed up on our secured servers. To recover your lost data: Send 0.1 BTC to our BitCoin Address and Contact us by eMail with your server IP Address and a Proof of Payment. Any eMail without your server IP Address and a Proof of Payment together will be ignored. You are welcome!"
99
100
dbbackups@protonmail.com10-09-2018dbbackups@protonmail.com3FAVraz3ovC1pz4frGRH6XXCuqPSWeh3UH0.6 BTC31.8Warning101.254.214.37https://pastebin.com/yUELwaT0
@MayhemDayOne
Your Database is downloaded and backed up on our secured servers. To recover your lost data: Send 0.6 BTC to our BitCoin Address and Contact us by eMail with your server IP Address and a Proof of Payment. Any eMail without your server IP Address and a Proof of Payment together will be ignored. We will drop the backup after 24 hours. You are welcome!