Mongodb Mass Enumeration And Database Destruction

Unauthenticated or opportunistic client performs broad MongoDB environment reconnaissance across multiple databases (admin, config, local, production, test) including handshake probing, database statistics gathering, collection enumeration, and bulk document listing of sensitive application datasets (users, sessions, api_keys, payments, orders, secrets, audit logs). Activity escalates to destructive actions via repeated dropDatabase commands and concludes with insertion of a ransom note database (READ_ME_TO_RECOVER_YOUR_DATA). This behavior pattern is characteristic of automated internet-wide MongoDB exploitation campaigns involving data wiping, extortion messaging, and opportunistic post-access reconnaissance.