ZeroFox Intelligence Flash Report - Increase in Threat Actor Activity Around Misconfigured MongoDB Instances

Standing Intelligence Requirements

• Data Leak
• Infrastructure Developments
• Threat Actor Activity

Key Findings

• ZeroFox identified an uptick in threat actor chatter this week regarding misconfigured MongoDB instances on port 27017, which suggests a risk of imminent data exfiltration and subsequent brokering of large, sensitive data sets.
• Threat actors use legal methods—such as port scanning and other publicly available tools—to identify misconfigured MongoDB instances; they exfiltrate data from them for use in onward cyber-based fraud schemes.
• Once exfiltrated, threat actors usually exploit the data themselves, sell it, and share it to gain credibility within dark web forums or marketplaces (or some combination thereof).

Analyst Commentary

ZeroFox identified an uptick in threat actor chatter this week regarding misconfigured MongoDB instances on port 27017, which suggests a risk of imminent data exfiltration and subsequent brokering of large, sensitive data sets. Port 27017 is the default connection point for MongoDB, a commonly used database system for cloud-based data storage and management.

• Although opening this port enables authorized users to access the database, it also creates potential risks—including the possibility of data being removed from the system without authorization.

Once the data is exfiltrated, threat actors usually exploit it themselves, sell it, or share it to gain credibility within dark web forums or marketplaces—or some combination thereof. ZeroFox notes multiple historical instances that illustrate how misconfigured 27017 ports in MongoDB can lead to serious data breaches.

• In 2017, Deep Root Analytics, a political consulting firm, exposed sensitive voter information of over 198 million individuals due to a misconfigured database with an open port 27017.
• The American Association of Veterinary Laboratory Diagnosticians (AAVLD), the State Bank of India, and Honda Motor Company also all left MongoDB databases exposed with the same open port, which resulted in the exposure of sensitive information that included member details, financial information, and customer data.

Recommendations

Unauthorized access: If an attacker gains access to a MongoDB instance through an open port, they can potentially access sensitive data stored in the database, such as user credentials or financial information.

Data exfiltration: An attacker who gains access to a MongoDB instance can also exfiltrate data by copying it to a remote location, such as their own server or cloud storage account.

Ransomware attacks: If an attacker gains access to a MongoDB instance, they can also use ransomware to encrypt the data and demand payment for the decryption key.

Denial of Service (DoS) attacks: Attackers can use DoS attacks to flood a MongoDB instance with traffic, making it unavailable to legitimate users.

There are several security measures that can be implemented to mitigate the risks of unauthorized access and data exfiltration associated with an open port 27017 in MongoDB, including limiting access to the MongoDB instance by configuring firewalls, using strong passwords, and implementing intrusion detection systems to detect and prevent unauthorized access. The MongoDB database should also be regularly backed up and monitored to detect and prevent potential data exfiltration or other security threats. This combination of security measures is essential for maintaining the integrity and confidentiality of sensitive data stored in MongoDB databases.