My MongoDB has been extorted by a kraken ransomware virus


Yesterday my database (MongoDB) had been deleted with a message:

{ “_id” : ObjectId(“5871ed160c474c47dc9f3e80”), “Info” : “Your DB is Backed up at our servers, to restore send 0.1 BTC to the Bitcoin Address then send an email with your server ip”, “Bitcoin Address” : “1J5ADzFv1gx3fsUPUY1AWktuJ6DF9P6hiF”, “Email” : “” }

And this morning, my restored database has been deleted one again. What can I do now? Please give some advice for this case.



How are they able to access mongo if I have my server setup using ssh keys? This post says that it is a virus. How did this virus get installed on my server and how do I remove it?

I have a firewall and it is active:

● ufw.service - Uncomplicated firewall
   Loaded: loaded (/lib/systemd/system/ufw.service; enabled; vendor preset: enabled)
   Active: active (exited) since Fri 2017-12-29 01:23:34 UTC; 1 weeks 4 days ago
 Main PID: ************** (code=exited, status=0/SUCCESS)
    Tasks: 0
   Memory: 0B
      CPU: 0
   CGroup: /system.slice/ufw.service

This comment has been deleted

Submit an answer
You can type!ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

I had the same problem because I deployed alpha edition and didn’t care security. I thought no body would know my server but some guy lurked in and asked for some BTC payment. That’s interesting how they knew my server address when it was just created, not in production yet. I ignored the message, set up firewall, limit source ip access, enable MongoDB authentication. So far, the issue hasn’t happened again yet. And one advice for you guys: NEVER PAY MONEY. They don’t care your data, all they want is money. If you pay money, you shot yourself twice.

Okay, I found the attacker’s IP is and make changes in iptables: /etc/sysconfig/iptables

-A INPUT -s -p tcp --dport 27017 -j DROP -A INPUT -s -p tcp --dport 80 -j DROP -A INPUT -s -p tcp --dport 22 -j DROP

-A INPUT -s -p tcp --dport 27017 -j ACCEPT -A INPUT -p tcp --dport 27017 -j DROP

Hope it works to me and stop deleting the databases.

Today I tried to connect to our MongoServer from another server, but it does not work. So I wonder how the virus does and is it running on our side server?

It does not stop deleting our database ;'(

Hello! I had the same problem on my server. The hole in sequrity is open connection to MongoDB. I wrote a short article how to protect your server Hope will be helpful!

Hello ,

I have also this problem on my server. and i have no backup from my server. any one please give me solution for backup my data from server.

Thanks in advance.

Had the same issue. SSH’d into the server and noticed a folder called dump was created in the home folder. I was able to restore it and setup authentication. Might help someone else

I use RoboMongo app on Mac to login with SSH permission to manage databases. This is only way my login information was stolen.

Anyone else?

I have the same problem.

I pay 2 days ago, but they don’t answer anymore. So don’t waste your money!

Same thing has happened to my system here. Let me know if you find any valuable solutions, and I’ll do same if I do, although the scum who did the hacking might be looking at conversation. Unlikely but possible.

They are able to access your MongoDB because it is exposed to the internet, ie anyone can access it. I assume that you don’t have a firewall in place to block these connections, if so then you’ll need to remedy this else it’ll continue to happen.

Mongo has some information on how to do this.