Blog

Security research, threat intelligence insights, and product updates.

March 21, 2026

The Debt Collector: A MongoDB Ransom Attack in 711 Milliseconds

Our MongoDB honeypot captured a complete ransomware operation: three simultaneous connections from the same IP, systematic database enumeration, full data exfiltration, three dropDatabase commands, and a ransom note inserted into READ_ME_TO_RECOVER_YOUR_DATA. Total time on target: 711 milliseconds.

honeypots threat intelligence mongodb ransomware database security data exfiltration nosql meow attack port 27017 ransom READ_ME_TO_RECOVER_YOUR_DATA database wipe Database

March 5, 2026

Introducing the Attack Session Database: Raw Honeypot Sessions, Searchable and Annotated

We're opening our attack session database in public beta. Browse and search real SSH commands, HTTP exploits, MySQL injections, Docker escapes, and more, captured by our globally distributed honeypot network. Every session is curated, annotated with behavioral analysis and matched attack primitives, and free to access.

honeypots