{
  "family": "mongolock",
  "sample_count": 7,
  "category": "ransomware",
  "description": "Ransom:Win32/Mongolock represents a highly specialized and devastating form of extortion that specifically targets unsecured, internet-exposed **MongoDB databases**, rather than individual user files or endpoints. It is a stark reminder of the dangers of cloud misconfigurations. Unlike traditional ransomware that encrypts files in place, Mongolock completely drops (deletes) the victim's databases and replaces them with a single collection containing a ransom demand, often resulting in total, irrecoverable data loss.<br><br><b>Understanding the Mongolock Threat</b><br>To an organization, a Mongolock attack is catastrophic. Their web applications suddenly crash, and upon inspecting the database, all customer records and operational data are gone, replaced by a table named `WARNING` demanding Bitcoin. For cloud security architects, Mongolock highlights a failure in basic access control (`T1190`); the database was left exposed to the public internet without authentication enabled.<br><br><b>Execution and Database Wiping Mechanics</b><br>Mongolock does not rely on phishing or malware payloads on an endpoint. Instead, attackers use automated scanning scripts (like Shodan or Masscan) (`T1595.002`) to scour the internet for MongoDB instances exposed on default port `27017` with no access controls configured (`T1190`). Once a vulnerable instance is found, the attacker's script connects directly to the database. It executes a command to completely drop (delete) all existing databases and collections (`T1485`). It then creates a new database (often named `READ_ME_TO_RECOVER_YOUR_DATA`) and inserts a single document demanding a ransom payment in cryptocurrency (`T1486`). Crucially, in many Mongolock attacks, the attackers *do not* actually back up the data before deleting it; paying the ransom results in nothing.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is immediate, total data loss and massive operational downtime. The primary IoC is the sudden disappearance of all MongoDB collections, replaced by a single ransom note collection. Cloud infrastructure logs (AWS CloudTrail, Azure Activity Log) will show unauthorized inbound connections to port `27017` from unknown IP addresses, followed immediately by massive data deletion commands.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Mongolock and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mongolock is classified as a Ransomware. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Mongolock establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mongolock typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Mongolock compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Mongolock should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms and file targeting techniques does Mongolock employ during execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mongolock typically leverages hybrid cryptographic architectures combining symmetric stream or block ciphers (such as AES-256 or ChaCha20) for rapid file encryption with asymmetric algorithms (such as RSA-2048 or Curve25519) to securely protect the session keys. It aggressively targets sensitive file extensions including corporate documents, databases, virtual disks, and backups while systematically executing commands to delete Volume Shadow Copies (vssadmin delete shadows /all /quiet) and disable system recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "Are decryptors available for Mongolock, and what is the recommended recovery procedure?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Decryption availability for Mongolock depends on whether security researchers or law enforcement (such as the No More Ransom initiative) have recovered the master private keys or discovered flaws in its key generation routines. Victims should never pay the extortion demand, as payment fuels criminal operations without guaranteeing file restoration. The recommended recovery procedure entails isolating infected hosts, conducting forensic disk imaging, identifying the root access vector, and restoring validated systems from immutable offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1595.002",
    "T1486",
    "T1190",
    "T1485"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application (Exploiting unauthenticated MongoDB instances)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1595.002",
      "name": "Active Scanning: Vulnerability Scanning (Mass-scanning for port 27017)",
      "tactic": "Reconnaissance"
    },
    {
      "id": "T1485",
      "name": "Data Destruction (Dropping the databases)",
      "tactic": "Impact"
    },
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact (Leaving the ransom note)",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "Immediately alter the cloud firewall/Security Group rules to block all public internet access to the MongoDB instance (Port 27017).",
    "Enable authentication and Role-Based Access Control (RBAC) on the MongoDB instance immediately.",
    "Do not pay the ransom. Mongolock attacks are frequently automated wipers; the attackers rarely exfiltrate or save the data before deleting it.",
    "Restore the database from the most recent secure, offline backup taken before the attack occurred."
  ],
  "what_to_avoid": [
    "Do not expose any database (MongoDB, Redis, Elasticsearch) directly to the public internet without strict IP allowlisting and strong authentication.",
    "Avoid assuming cloud providers secure your data by default; securing database access is a customer responsibility under the Shared Responsibility Model."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}